forteza.cc impersonated Epic Games behind a page titled "Inventory Check | Fortnite". It targeted Fortnite players who might want to see or verify their skins, items and V-Bucks. PhishDestroy first flagged the domain on 2026-09-16. The site has been offline since 2026-10-14 and was still unreachable when checked on 2026-10-19.
How the scam works
An "inventory check" lure plays on players' attachment to the cosmetics they have bought or earned. The page promises to show or validate what an account holds, then asks the visitor to sign in with their Epic Games credentials, sometimes including a verification code. Whatever is typed goes to the operators instead of Epic. With those details they can take over the account, change its email and password, and lock the owner out. That puts the item collection, the V-Bucks balance and any saved payment methods in the hands of the thieves.
Evidence
Eleven of 91 VirusTotal engines flagged the domain as of 2026-09-29. The named vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, Gridinsoft and Lionic. That count is modest, but these are established vendors reaching the same verdict independently. urlscan.io rated the page malicious and recognised Epic Games branding on it. Spamhaus lists the domain in its DBL as spam, and it appears in four AlienVault OTX threat pulses alongside the PhishDestroy blocklist.
Infrastructure
The domain was registered on 2026-07-31 through Global Domain Group LLC, about seven weeks before PhishDestroy detected it. That suggests it was set up in advance rather than used the day it was bought. Traffic resolved to Cloudflare's network, with a Canadian location, so the real origin server stayed behind the proxy. The certificate from Google Trust Services gave the page a normal padlock, which says nothing about whether a site is genuine.
What to do
If you entered your Epic Games login on this page, change that password now, along with any other account where you reused it. Then turn on two-factor authentication in your Epic account settings. Review your recent purchases, linked payment methods and connected platforms, and contact Epic Games support if anything changed or you are locked out. Only check your Fortnite inventory inside the game or on Epic's official site. Defenders should block forteza.cc and treat Fortnite "inventory" or "item check" pages on unfamiliar domains as credential-phishing indicators.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
