# PhishDestroy threat dossier — fortniteplay.top ================================================================ Fetched: 2026-05-14 18:18:14 UTC Canonical: https://phishdestroy.io/domain/fortniteplay.top/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 74/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 13/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data, Gridinsoft, LevelBlue, Lionic, Sophos, VIPRE URLQuery: 3 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: aria.ns.cloudflare.com, moura.ns.cloudflare.com Registered: 2026-04-23 Page title: Fortnite Inventory Checker | Epic Games ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-23 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-14 19:45:31 UTC (by PhishDestroy tracker) Last verified: 2026-05-14 20:32:16 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e275f-1e08-71cb-ab09-cc58fca80baa/ Wayback Machine: https://web.archive.org/web/*/fortniteplay.top crt.sh CT logs: https://crt.sh/?q=%25.fortniteplay.top Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=fortniteplay.top AlienVault OTX: https://otx.alienvault.com/indicator/domain/fortniteplay.top URLhaus: https://urlhaus.abuse.ch/host/fortniteplay.top/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-14 19:46:28 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] fortniteplay.top has been identified as engaging in brand impersonation, specifically targeting the popular gaming platform Epic Games and its Fortnite ecosystem. This domain poses an elevated risk due to its deceptive design, which closely mimics legitimate Epic Games services to trick users into divulging sensitive information or transferring cryptocurrency. The primary threat type here is brand impersonation with potential secondary risks including credential theft and crypto drainer activity, as evidenced by the domain's title and structure. Users should exercise extreme caution and avoid interacting with this domain under any circumstances. This domain was flagged by PhishDestroy using a multi-factor threat intelligence pipeline. Key technical indicators include registration through PDR Ltd. d/b/a PublicDomainRegistry.com, resolution to IP address 188.114.97.3, and a VirusTotal detection ratio of 13 out of 95 security vendors as of the latest scan. The domain was created on April 23, 2026, and currently holds a Let's Encrypt SSL certificate, which may further lend it an air of legitimacy. Despite this certificate, the domain's recent creation date and high detection ratio on VirusTotal indicate a newly active threat with minimal reputation. The page title, 'Fortnite Inventory Checker | Epic Games,' directly mimics legitimate Epic Games services, suggesting a deliberate attempt to deceive users. Given the specific threat type of brand impersonation with potential crypto drainer functionality, users should immediately cease all interaction with fortiniteplay.top and report the domain to their security teams or through platforms like PhishDestroy. If you have accidentally entered credentials or cryptocurrency wallet details on this domain, revoke those credentials or transfer funds to a secure wallet immediately. Block the IP address 188.114.97.3 and domain at your network perimeter, and ensure your antivirus or endpoint protection solutions are updated to detect and block this threat. Users are advised to access Epic Games services only through verified, official channels and enable multi-factor authentication on all gaming and cryptocurrency-related accounts. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fortniteplay.top/ JSON API: https://api.destroy.tools/v1/check?domain=fortniteplay.top Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,313 domains (36,840 alive under monitoring, 111,693 confirmed takedowns/dead). Site: https://phishdestroy.io