lokfort[.]lol

The domain lokfort.lol was observed on July 24, 2026 and assigned an elevated risk rating as a generic phishing site. Registration data shows the domain was created on May 20, 2026 through Global Domain Group LLC, and authoritative nameservers are coleman.ns.cloudflare.com and mckinley.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to IP address 188.114.96.3, which is owned by Cloudflare, Inc. and geolocated to Canada. The site presented an HTTPS service secured by a Let’s Encrypt certificate (E8).

Prior to being taken offline, the page title retrieved from the site was "Inventory Check | Fortnite," indicating an attempt to target users of the Fortnite brand. VirusTotal scans recorded four detections out of ninety‑five security vendors, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked, and the Gridinsoft trust score is 0 out of 100, reflecting a strong malicious assessment. Automated fingerprinting identified the use of Tailwind CSS, Cloudflare Browser Insights, Cloudflare services, and HTTP/3.

The current offline status limits direct content inspection, so the precise phishing page layout and credential‑capture mechanisms remain unverified. Nevertheless, the convergence of a brand‑related page title, low trust score, multiple vendor detections, and blocklist presence substantiates the phishing classification. Defensive recommendations include enforcing DNS‑level blocking for lokfort.lol, updating web and email filtering rules to flag any URLs containing this domain, and monitoring threat‑intel feeds for re‑use of the same Cloudflare IP range or similar naming patterns. Incident responders encountering traffic to this domain should treat it as malicious, isolate affected systems, and preserve any submitted data for forensic analysis while remaining vigilant for potential campaign resurgence.