revoloor[.]com

The domain revoloor.com is identified as a credential theft operation impersonating the Fortnite gaming platform. Analysis indicates the site was designed to deceive users into submitting login credentials under the pretense of accessing a "Fortnite Wealth Leaderboard," a fabricated feature not associated with the legitimate Epic Games service. The domain is currently offline, but its infrastructure and historical activity warrant scrutiny for potential reemergence or related campaigns.

Technical indicators reveal the domain was registered on November 01, 2025, through MAT BAO CORPORATION, a registrar with a history of hosting malicious infrastructure. Security vendors flagged revoloor.com in 17 of 95 VirusTotal scans, while it appears on one security blocklist and is referenced in two AlienVault OTX threat intelligence pulses. The site employed Cloudflare for hosting and DDoS protection, alongside HTTP/3 and Cloudflare Browser Insights for performance monitoring. Additional technologies detected include Tailwind CSS for styling and Mautic for marketing automation, suggesting an attempt to mimic legitimate user engagement tactics. Gridinsoft assigned the domain a trust score of 0/100, further corroborating its malicious classification.

Given the domain's current offline status, the immediate threat to users is mitigated. However, the infrastructure and techniques observed align with persistent credential theft campaigns targeting gaming communities. Users are advised to verify the authenticity of any Fortnite-related communications or promotions by accessing official Epic Games channels directly. Organizations should monitor for domain resurgence or similar impersonation attempts, particularly those leveraging gaming leaderboards or reward-based lures. Security teams should update blocklists to include revoloor.com and related indicators, while educating users on recognizing brand impersonation tactics in phishing campaigns.