trade-fortunes[.]com

Analysis of trade-fortunes.com shows it resolves to the IPv4 address 13.248.169.48 and returns HTTP status 200, confirming the host is actively serving web content. The site presents a valid SSL certificate issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV - R1v1), which does not mitigate the phishing risk. Infrastructure data indicates the IP is hosted in Canada and is part of an AWS Global Accelerator deployment, suggesting use of a cloud‑based delivery network to obscure the true origin. The domain is delegated to Afternic’s nameservers (ns1.afternic.com, ns2.afternic.com, verification-d3jclucsp89ganyqbydeny.ns) and is listed on at least one public blocklist. It has been flagged by PhishDestroy and appears in three AlienVault OTX threat pulses, reinforcing its malicious reputation. VirusTotal scans show four of ninety‑one security vendors flagged the domain, providing additional independent confirmation of abuse. Registration records list DropWeek.com, LLC as the registrar, and the domain remains active as of the report date. No public analysis of the page content, targeted brand, or phishing kit has been released, leaving the exact lure and credential‑capture method uncertain. Defenders should block trade-fortunes.com at DNS and proxy layers, monitor traffic to its AWS‑accelerated IP, and add the domain to internal threat intelligence feeds. Continuous re‑scanning of the URL and periodic review of OTX and blocklist updates are recommended to capture any evolution in the campaign.