gxfort[.]pro

On July 22, 2026, analysis of gxfort.pro identified a brand‑impersonation campaign targeting Epic Games. The site presented the page title “Fortnite Wealth Leaderboard | Epic Games,” indicating a fake airdrop that attempts to lure Fortnite players with promises of wealth. The domain was registered on February 4, 2026 through Global Domain Group LLC and resolves to the Cloudflare‑hosted IP address 188.114.96.3, which is geolocated to Canada. The hosting provider is CloudFlare, Inc., and the SSL certificate is issued by Google Trust Services under the WE1 authority, suggesting the site used a legitimate certificate to increase credibility. Nameserver records point to lorna.ns.cloudflare.com and ram.ns.cloudflare.com, consistent with the Cloudflare infrastructure.

The domain is currently offline but was previously blocked by the PhishDestroy service and appears on one external security blocklist. VirusTotal scans reported three detections out of ninety‑five scanners, providing independent confirmation of malicious activity. Gridinsoft assigned a trust score of 0 / 100, indicating a high confidence that the site is malicious. No additional public indicators such as malware hashes, phishing URLs, or payload samples were observed, leaving the exact delivery mechanism of the airdrop lure unknown.

Defenders should immediately add gxfort.pro to DNS‑based blocklists and firewall deny lists, and also block its underlying IP address 188.114.96.3 to prevent accidental resolution. Monitoring of Cloudflare name‑server traffic for similarly crafted domains is advised, as the infrastructure can be reused for rapid re‑hosting. Because the SSL certificate is from a reputable authority, reliance on certificate validation alone is insufficient; endpoint security solutions should be configured to flag any attempt to download or execute files associated with the “Fake Airdrop” pattern.