fnzona[.]lol

This domain operated as a credential theft site targeting Fortnite players by impersonating an official Epic Games inventory checker. The fraudulent page prompted users to enter account credentials under the pretense of verifying in-game items, enabling attackers to harvest login details for unauthorized access to gaming accounts and linked payment methods. The scheme specifically exploited the popularity of Fortnite and the perceived legitimacy of inventory management tools to deceive victims. Analysis indicates the domain was registered through Dynadot Inc on April 14, 2026, and resolved to IP address 104.21.74.186. Security vendors flagged the domain in 17 out of 95 VirusTotal scans, while it appeared on one security blocklist and was documented in a single AlienVault OTX threat intelligence pulse. The site employed Cloudflare for hosting and used Tailwind CSS for styling, with HTTP/3 protocol support, suggesting an attempt to mimic modern web infrastructure while evading detection. Users who visited fnzona.lol and entered credentials should immediately change their Epic Games account password and enable multi-factor authentication. Monitor the account for unauthorized purchases or inventory changes, and review linked payment methods for fraudulent transactions. If financial data was entered, contact the associated financial institution to flag potential fraud. Security teams should block the domain and IP address 104.21.74.186 in network defenses to prevent further exposure.