fortnitepro[.]live

This domain, fortnitepro.live, is confirmed as a credential theft operation designed to impersonate the popular gaming platform Fortnite. Analysis indicates the site employs social engineering tactics to deceive users into entering account credentials, which are then harvested for unauthorized access or resale. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting campaigns targeting gaming communities. The domain’s design and naming convention strongly suggest an intent to exploit Fortnite’s brand recognition and user base. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 19, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 91.92.243.12, which has been linked to other malicious activities. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns it a trust score of 5 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The site employs HTTP/3, a protocol that may be used to evade traditional detection mechanisms by leveraging encrypted traffic. As of the latest assessment, fortnitepro.live has been taken offline, likely in response to detection and blocking by security vendors. However, the domain’s registration remains active, posing a residual risk of reactivation or migration to a new infrastructure. Users who may have interacted with the site are advised to reset their Fortnite account credentials immediately and enable multi-factor authentication. Organizations should monitor for indicators of compromise, including the IP address 91.92.243.12 and the domain itself, within their network logs. The elevated risk level persists due to the domain’s recent activity and the potential for reemergence under a different guise.