fortunx-i[.]com

Analysis of fortunx-i.com shows a short‑lived infrastructure that was active in early 2026 and is now taken offline. The site presented the page title “Fortunex” and was hosted behind Cloudflare, resolving to IP address 104.21.93.76, which is assigned to Cloudflare, Inc. in Canada. The TLS certificate was issued by Let’s Encrypt and the site advertised modern security headers, including HSTS, and served content built with Vue.js over HTTP/3.

Domain registration details indicate the name was created on March 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative nameservers are brynne.ns.cloudflare.com and will.ns.cloudflare.com. VirusTotal scans recorded six positive detections out of ninety‑four scanners, confirming malicious classification by multiple vendors. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing its status as a phishing‑related resource.

While the exact payload or credential‑stealing mechanism has not been observed, the convergence of a brand‑like page title, rapid registration, Cloudflare‑based hosting, and multiple vendor detections strongly suggests a generic phishing operation. Defenders should continue to deny DNS resolution for fortunx-i.com, enforce outbound filtering to prevent connections to its IP range, and monitor for re‑registration or reuse of the same nameserver configuration. Threat intelligence platforms should retain the indicator set, and incident response teams should treat any traffic to the domain as malicious, even though the site is currently offline.