fortniteloot[.]top

This domain, fortniteloot.top, is identified as a credential phishing site impersonating the official Fortnite gaming platform, specifically targeting users of the fictional "Rivalries: Chapter 7 Season 2" event. The domain is currently offline, though prior analysis confirms its malicious intent to harvest user credentials or distribute malware under the guise of in-game rewards or exclusive content. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 28, 2026, and resolved to the IP address 104.21.33.239, hosted on Cloudflare's network (AS13335). Security vendor detections on VirusTotal indicate 23 of 95 engines flagged the domain as malicious, while it appears on one additional security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E8), was likely used to lend superficial legitimacy to the phishing page. The page title, "Fortnite — Rivalries: Chapter 7 Season 2," mirrors the branding style of legitimate Fortnite updates, increasing the likelihood of user deception. The domain's current offline status reduces immediate risk, but its prior activity and infrastructure warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address at the network level. End-users should be educated on recognizing phishing attempts, particularly those leveraging popular gaming franchises. Security teams are encouraged to review logs for connections to 104.21.33.239 or interactions with the domain during its active period, as these may indicate compromised credentials or attempted malware execution.