fortunx-h[.]com

On July 22, 2026, the domain fortunx-h.com was observed to host a web page titled “Treasury”. The domain was registered on March 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IPv4 address 65.20.73.254, which is owned by Vultr Holdings LLC and geolocated to India. The authoritative name servers are brynne.ns.cloudflare.com and will.ns.cloudflare.com, indicating that the domain leverages Cloudflare’s DNS and likely its edge services. A TLS certificate issued by Let’s Encrypt was found in place, providing HTTPS encryption but offering no indication of legitimacy.

The web server identifies as Nginx and serves a front‑end built with Vue.js. HTTP response headers include HSTS and the site negotiates HTTP/3, suggesting a fairly modern deployment. Despite these technical characteristics, the domain has a Gridinsoft trust score of 0 out of 100, signaling a complete lack of trust. It is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal records show that five of ninety‑four scanners flagged the domain, confirming that at least some security engines perceive it as malicious.

The overall risk assessment is elevated, and the domain status is reported as offline, meaning the site is no longer reachable at the time of analysis. The combination of a recent registration, use of a reputable CDN provider, a generic “Treasury” page title, and low trust scores aligns with patterns commonly associated with credential‑harvesting infrastructure. However, no direct evidence of the page content, login forms, or targeted brand has been captured, leaving the exact phishing vector unconfirmed. Defenders should ensure that any outbound connections to 65.20.73.254 are blocked at the network perimeter, update endpoint allowlists to include the Cloudflare name servers as benign, and monitor for future re‑activation of the domain.