fortnitechecking[.]top

The domain fortnitechecking.top is currently active and classified as a credential theft scam specifically targeting users of the popular gaming platform Fortnite. Analysis indicates this site is designed to harvest login credentials by mimicking official Fortnite authentication portals, a tactic commonly employed in account takeover schemes. The domain remains operational as of the latest assessment, posing a high risk to unsuspecting users. Infrastructure analysis reveals that fortnitechecking.top is flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain was registered on June 12, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing infrastructure. It resolves to the IP address 104.21.60.127, which is part of a cloud hosting range known for hosting transient malicious domains. The SSL certificate is issued by Let's Encrypt (identifier YE2), a common choice for threat actors due to its free and automated issuance process. The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its malicious classification. Current status confirms that fortnitechecking.top remains active and accessible, continuing to pose a threat to users. Security recommendations include blocking the domain and its associated IP at the network level, as well as implementing browser-based protections to prevent user navigation. Organizations should update endpoint detection systems to include this domain in threat intelligence feeds. Users are advised to verify the legitimacy of any Fortnite-related login portal by cross-referencing the URL with official sources and enabling multi-factor authentication to mitigate the risk of credential theft.