vbucks[.]luxe

This domain, vbucks.luxe, is flagged as a brand impersonation phishing site targeting Fortnite, a popular online gaming platform. Analysis indicates the site was designed to deceive users by mimicking official Fortnite promotions, specifically referencing "Rivalries: Chapter 7 Season 2" in its page title. No direct evidence of a crypto drainer or credential harvesting kit was observed, but the use of Cloudflare and Tailwind CSS suggests an attempt to create a visually convincing facade while obscuring backend infrastructure. The domain’s association with a known phishing campaign aligns with tactics used to distribute fake in-game rewards or V-Bucks, Fortnite’s virtual currency, to lure victims. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 15, 2026, an unusually forward-dated registration that may indicate an attempt to evade immediate detection or expiration-based scrutiny. The domain resolves to the IP address 188.114.97.3, a Cloudflare endpoint commonly used to mask origin servers. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on a single security blocklist and is referenced in one AlienVault OTX threat intelligence pulse. Technologies detected include HTTP/3, Cloudflare Browser Insights, and Tailwind CSS, further indicating a modern, evasive phishing infrastructure designed to bypass traditional security controls. As of the latest verification, vbucks.luxe has been taken offline, likely due to enforcement actions by hosting providers or security teams. However, the risk of reemergence remains elevated given the domain’s recent registration and the persistent targeting of Fortnite’s user base. Organizations and individuals are advised to monitor for related infrastructure, particularly domains registered under NICENIC or resolving to Cloudflare IPs with similar naming conventions. Users should be cautioned against interacting with unsolicited Fortnite promotions, especially those offering free V-Bucks or exclusive in-game content, as these are common vectors for phishing and malware distribution. Network-level blocking of the IP 188.114.97.3 and domains with the "luxe" TLD exhibiting similar patterns is recommended for proactive defense.