fortnite-locker[.]cc

This domain, fortnite-locker.cc, is flagged as a credential harvesting phishing site targeting users through deceptive login prompts. The threat is classified as elevated risk due to its active distribution in phishing campaigns and confirmed detection by multiple security mechanisms. Credential harvesting remains a prevalent attack vector, often leveraging social engineering to exploit user trust in seemingly legitimate interfaces. Analysis indicates the domain was registered on May 30, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with newly created malicious domains. Infrastructure analysis reveals the domain resolves to the IP address 91.227.114.14, which has been linked to prior phishing operations. Detection metrics show 6 out of 95 security vendors on a prominent threat intelligence platform flagged the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by a specialized anti-phishing system. The page title, 'Loading,' suggests an attempt to mimic legitimate service initialization while concealing malicious intent. HTTP/3 protocol usage further indicates efforts to evade traditional detection methods by leveraging modern web technologies. Mitigation against credential harvesting phishing requires a multi-layered approach. Network-level protections should include blocking the domain and its associated IP address, 91.227.114.14, across all security gateways. Endpoint solutions must enforce real-time URL filtering to prevent user access to newly registered or low-reputation domains. User awareness training should emphasize the risks of entering credentials on untrusted sites, particularly those with recent registration dates or generic page titles. Organizations are advised to implement multi-factor authentication to reduce the impact of compromised credentials. Continuous monitoring of newly registered domains under similar registrars, such as Gname.com Pte. Ltd., can aid in early detection of emerging threats.