fnview[.]cc

This domain, fnview.cc, is identified as a high-risk credential theft operation impersonating the Fortnite gaming platform. The page title, 'Inventory Check | Fortnite,' suggests an attempt to deceive users into submitting account credentials under the guise of verifying in-game inventory or rewards. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics commonly deployed in gaming-related phishing campaigns. The domain’s design and branding mimic legitimate Fortnite interfaces to lower user suspicion and increase the likelihood of successful credential capture. Analysis of technical indicators reveals the following: the domain was registered on May 18, 2026, through NameSilo, LLC, and currently resolves to the IP address 85.239.149.81. Security vendors on VirusTotal flagged the domain as malicious, with 19 out of 95 detections. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and CERT-PL. Detected technologies include Tailwind CSS, Nginx, and OpenResty, which are often leveraged in phishing infrastructure for rapid deployment and scalability. Gridinsoft assigned a trust score of 0/100, further corroborating the domain’s malicious classification. As of the latest assessment, fnview.cc has been taken offline, likely due to takedown efforts or abandonment by the threat actor. However, the infrastructure may resurface under a different domain or IP address, given the transient nature of phishing campaigns. Users who interacted with this domain are advised to reset their Fortnite account credentials immediately and enable multi-factor authentication. Organizations should monitor for similar domains registered through NameSilo or resolving to 85.239.149.81, as these may indicate related threat actor activity. The remaining risk persists due to the potential for credential reuse across platforms and the likelihood of future campaigns targeting the same user base.