fortunemaster[.]io

Analysis as of July 22 2026 identifies fortunemaster.io as an active infrastructure hosting a cryptocurrency‑related fraud that masquerades as the MetaMask wallet brand. The domain was registered on February 21 2026 through NameCheap, Inc., and resolves to the IP address 198.54.120.198, which belongs to AS22612, a Namecheap hosting network located in the United States. The web server returns an HTTP 301 redirect and presents the page title “FortuneMaster - Unlock Your Fortune”, a phrasing that aligns with the declared scam type “Crypto Scam”. TLS termination uses a Sectigo Public Server Authentication CA DV R36 certificate, indicating a legitimate‑looking SSL certificate but offering no assurance of legitimacy. Service fingerprinting reveals a stack comprising Node.js, Express, LiteSpeed, and Cloudflare as a CDN front‑end, together with client‑side libraries such as OWL Carousel, jsDelivr, and jQuery pulled from public CDNs.

MX records point to mx1-hosting.jellyfish.systems (priority 5) and a secondary host with priority 10, suggesting email capability but without further verification. The domain is listed on one security blocklist and has been flagged by PhishDestroy. VirusTotal reports a single positive detection out of 95 scanning engines, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low confidence rating.

The combination of recent registration, low trust score, active blocklisting, and the explicit claim of impersonating MetaMask indicates a high‑risk profile. Uncertainty remains regarding the exact payload delivered to victims, as no page content analysis is available beyond the title. Defenders should block DNS resolution for fortunemaster.io, add the domain to URL filtering and email security policies, monitor outbound connections to 198.54.120.198, and enforce user awareness messaging that warns against unsolicited offers promising “fortune” tied to MetaMask.