blucex[.]com

This domain is flagged as a high-risk generic phishing threat specifically designed to impersonate Fortnite's inventory verification system. Analysis indicates the site employs brand impersonation tactics to harvest user credentials or distribute malicious payloads under the guise of in-game rewards or account validation. The page title 'Inventory Check | Fortnite' directly mimics legitimate Epic Games authentication flows, increasing the likelihood of user deception. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain blucex.com was registered on March 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 172.67.197.247. It appears on 3 security blocklists and is flagged by 18 out of 95 security vendors on VirusTotal. Additional technical observations include a Gridinsoft trust score of 0/100, use of Cloudflare for hosting (including HTTP/3 and Browser Insights), and detection by PhishDestroy, PhishingArmy, and CERT-PL. The domain has since been taken offline, though historical DNS records confirm its prior malicious activity. Mitigation requires immediate action from both end users and network administrators. Users who may have interacted with this domain should assume credential compromise and initiate password resets for all associated accounts, particularly Epic Games logins. Multi-factor authentication should be enabled where available. Network-level protections should include blocking the domain and its resolving IP (172.67.197.247) at perimeter security devices. Organizations should also monitor for internal connections to the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, as this entity has been recurrently associated with malicious domain registrations. Security teams are advised to review logs for any prior connections to blucex.com or its IP, with particular attention to user agents containing 'Fortnite' or 'Inventory Check' in HTTP headers.