fortskin[.]club

This domain, fortskin.club, is a phishing site designed to steal user credentials by impersonating the official Fortnite Wealth Leaderboard. The site presents a fraudulent login interface under the guise of Epic Games, tricking users into entering their account details. Once submitted, these credentials are harvested by threat actors for unauthorized access, account takeovers, or further malicious activities such as financial fraud or identity theft. The site specifically targets Fortnite players, leveraging the popularity of the game to increase the likelihood of successful phishing attempts. Analysis indicates that fortskin.club was registered on June 07, 2026, through Global Domain Group LLC, a registrar often associated with domains used in phishing campaigns. The domain is flagged by 18 out of 95 security vendors on VirusTotal, a clear indicator of its malicious nature. It resolves to the IP address 104.21.41.95, which has been linked to other suspicious domains. Additionally, the site appears on one security blocklist and was previously blocked by PhishDestroy, further confirming its classification as a phishing threat. The page title, 'Fortnite Wealth Leaderboard | Epic Games,' is crafted to mimic legitimate Epic Games content, enhancing its deceptive appearance. If you or someone else visited fortskin.club and entered login credentials, immediate action is required to mitigate potential damage. First, change the password for the affected Fortnite or Epic Games account, as well as any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts to add an extra layer of security. Monitor the account for any unauthorized transactions, in-game purchases, or changes to account settings. If financial information was entered, contact the relevant financial institution to report potential fraud and request a review of recent transactions. Finally, scan the device used to access the site with up-to-date antivirus software to detect and remove any malware that may have been installed during the visit.