fortxl[.]top

Analysis as of July 26, 2026 indicates that fortxl.top is an active malicious site. The domain was registered on April 03, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on IP 188.114.96.3, which belongs to Cloudflare’s network. The authoritative nameservers gordon.ns.cloudflare.com and tessa.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure, a common choice for threat actors seeking rapid deployment and traffic obfuscation. The page title returned from the live host reads "Fortnite Inventory Checker | Epic Games", suggesting the site is attempting to lure players of the popular game Fortnite into providing credentials or personal data.

The site is currently listed on two security blocklists and has been flagged by the PhishDestroy and OpenPhish feeds, reinforcing its classification as a phishing vector. VirusTotal scans show that 17 of 91 security vendors have raised detections on the domain, indicating a moderate level of consensus among scanners about its malicious nature. Publicly available intelligence does not include a full HTTP response code, SSL certificate details, or a description of the page’s content beyond the title, leaving the exact payload and credential‑capture mechanisms unconfirmed. Defenders should assume that the domain is being used to harvest Epic Games account credentials or to distribute additional malware.

Immediate mitigation steps include adding fortxl.top to network‑level blocklists, configuring web‑proxy filters to deny HTTP/HTTPS requests to the domain, and updating endpoint protection signatures to reflect the 17 vendor detections. Continuous monitoring of the IP address and associated Cloudflare nameservers is advised, as the operator may shift hosting or deploy new sub‑domains. Organizations with employees who play Fortnite should be warned about unsolicited inventory‑check links and instructed to verify URLs against official Epic Games domains before entering any credentials.