fortexxcapital.com is an impersonation phishing page that presents itself as FortexxCapital, a name styled to look like an investment or capital-management firm. It targets people looking for somewhere to invest or trade. PhishDestroy first flagged it on 2026-09-17, and as of 2026-10-19 the site was still online and serving its content.
How the scam works
The page carries the title "Fortexxcapital | FortexxCapital" and repeats the brand name to give the look of an established finance house. Impersonation sites of this kind borrow a firm's identity to win trust, then ask visitors to open an account, enter login details or personal information, or send money for an "investment." Victims can lose the account credentials they type in, personal or identity data, and any funds they deposit. Money sent to such operations is rarely recoverable.
Evidence
On 2026-10-01, 5 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Netcraft and SOCRadar. That is a small share of engines, but it comes from several unrelated vendors, including Netcraft, which specialises in phishing takedowns. The domain also appears in 4 AlienVault OTX threat pulses, which means other researchers have tracked it independently. Among blocklists, it is currently listed by PhishDestroy.
Infrastructure
The domain was registered on 2026-07-23 through TuringSign Inc. d/b/a Cosmotown, about eight weeks before PhishDestroy detected it. It sits behind Cloudflare on IP 172.67.203.130, with the network located in Canada. This hides the real origin server. Its HTTPS certificate is issued by Google Trust Services (WE1), so the browser padlock only shows the connection is encrypted. It says nothing about whether the business is legitimate.
What to do
If you created an account or entered a password here, change that password everywhere you reused it and turn on two-factor authentication. If you sent money, stop all further payments, especially any requested "fees" or "taxes" to unlock a withdrawal. Contact your bank or payment provider right away and file a report with local authorities. If you uploaded ID documents, watch for identity misuse and consider a credit alert. Defenders should block fortexxcapital.com at DNS and proxy level and watch for lookalike domains using the FortexxCapital name.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-19 22:29:18 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:35:32 UTClast content: 2026-10-19 22:29:18 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Recorded subdomains3
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
account.fortexxcapital.comDomain record
online.fortexxcapital.comDomain record
www.fortexxcapital.comDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 7 identified
Y
YouTube
Video players
YouTube is a video sharing service where users can create their own profile, upload videos, watch, like and comment on other videos.
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
