# PhishDestroy threat dossier — fortxl.top ================================================================ Fetched: 2026-07-29 14:30:44 UTC Canonical: https://phishdestroy.io/domain/fortxl.top/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Epic Games ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 17/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Cluster25, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, OpenPhish, SOCRadar, Sophos, VIPRE, Webroot URLQuery: 2 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: gordon.ns.cloudflare.com, tessa.ns.cloudflare.com Registered: 2026-04-03 Expires: 2027-04-03 Page title: Fortnite Inventory Checker | Epic Games ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-08-30 Status: INVALID chain Fingerprint: 0139965341dfeee00d7418329f44e11d316f4c0fc58bc4e4e179e7dd5db5f177 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-03 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-26 14:33:53 UTC (by PhishDestroy tracker) First reported: 2026-07-26 12:35:22 UTC (abuse notice filed) Last verified: 2026-07-29 16:20:27 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f9e6a-5fc3-7374-b860-05fe01e6b0bd/ URLQuery: https://urlquery.net/report/d338cfed-e605-404a-8cc8-70eb9008fc82 Wayback Machine: https://web.archive.org/web/*/fortxl.top crt.sh CT logs: https://crt.sh/?q=%25.fortxl.top Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=fortxl.top AlienVault OTX: https://otx.alienvault.com/indicator/domain/fortxl.top URLhaus: https://urlhaus.abuse.ch/host/fortxl.top/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 14:38:39 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is fortxl.top a phishing scam? Analysis as of July 26, 2026 indicates that fortxl.top is an active malicious site. The domain was registered on April 03, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on IP 188.114.96.3, which belongs to Cloudflare’s network. The authoritative nameservers gordon.ns.cloudflare.com and tessa.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure, a common choice for threat actors seeking rapid deployment and traffic obfuscation. The page title returned from the live host reads "Fortnite Inventory Checker | Epic Games", suggesting the site is attempting to lure players of the popular game Fortnite into providing credentials or personal data. The site is currently listed on two security blocklists and has been flagged by the PhishDestroy and OpenPhish feeds, reinforcing its classification as a phishing vector. VirusTotal scans show that 17 of 91 security vendors have raised detections on the domain, indicating a moderate level of consensus among scanners about its malicious nature. Publicly available intelligence does not include a full HTTP response code, SSL certificate details, or a description of the page’s content beyond the title, leaving the exact payload and credential‑capture mechanisms unconfirmed. Defenders should assume that the domain is being used to harvest Epic Games account credentials or to distribute additional malware. Immediate mitigation steps include adding fortxl.top to network‑level blocklists, configuring web‑proxy filters to deny HTTP/HTTPS requests to the domain, and updating endpoint protection signatures to reflect the 17 vendor detections. Continuous monitoring of the IP address and associated Cloudflare nameservers is advised, as the operator may shift hosting or deploy new sub‑domains. Organizations with employees who play Fortnite should be warned about unsolicited inventory‑check links and instructed to verify URLs against official Epic Games domains before entering any credentials. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260726-44A1BA Favicon MD5: 195d82e6464344fd0ef2ca0c79879a9f TLS cert SHA-256: 0139965341dfeee00d7418329f44e11d316f4c0fc58bc4e4e179e7dd5db5f177 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fortxl.top/ JSON API: https://api.destroy.tools/v1/check?domain=fortxl.top Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,479 domains (83,246 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io