fncheck[.]org

The domain fncheck.org is identified as a phishing site specifically designed to impersonate Epic Games' Fortnite platform, targeting users with a fraudulent wealth leaderboard login page. Analysis confirms this as a credential harvesting operation, where victims are likely lured into entering account details under false pretenses. The domain is currently offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and has been flagged by 17 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. Additional technical indicators include a Gridinsoft trust score of 0/100, reinforcing its classification as malicious infrastructure. The page title, 'Fortnite Wealth Leaderboard | Epic Games,' directly mimics legitimate Epic Games branding to enhance credibility. Current status indicates the domain has been taken offline, though residual risk remains due to potential re-emergence under similar infrastructure. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for related indicators, including domains registered through the same registrar or resolving to the same IP range. Users who may have interacted with the site should immediately reset credentials for any accounts entered and enable multi-factor authentication where available. Proactive threat hunting for related phishing campaigns is recommended to mitigate further exposure.