fortnitezone[.]top

This domain, fortnitezone.top, is flagged as a credential phishing site targeting users of the Epic Games platform, specifically the Fortnite gaming community. The page title, 'Fortnite Inventory Checker | Epic Games,' suggests an attempt to deceive victims into believing they are accessing a legitimate Epic Games service. No specific drainer kit signatures were identified in the initial analysis, but the use of Tailwind CSS and Mautic indicates a structured phishing infrastructure designed for credential harvesting or account compromise. The domain mimics official Epic Games branding to exploit user trust and urgency around in-game inventory checks. Analysis indicates fortnitezone.top was detected by 21 out of 95 security vendors on VirusTotal, reflecting a moderate-to-high confidence level in its malicious nature. The domain was registered through Global Domain Group LLC on June 7, 2026, and resolved to the IP address 172.67.193.251, a Cloudflare-associated endpoint. It appeared on one security blocklist and was blocked by at least one anti-phishing service. The domain's creation date is anomalous, as it predates the current date by several years, suggesting either a typo-squatting attempt or an error in registration data. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, though this does not diminish the domain's verified malicious activity. As of the latest assessment, fortnitezone.top has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the infrastructure analysis reveals residual risk, as the domain's registration remains active under Global Domain Group LLC, and the IP address may still host other malicious content. Users who interacted with the site should assume credential exposure and initiate password resets on associated Epic Games accounts. Organizations are advised to monitor for similar phishing domains using the 'fortnitezone' naming convention or leveraging Cloudflare-based hosting for credential theft. The elevated risk level persists due to the domain's recent activity and the potential for re-deployment under a different IP or registrar.