fortnitemoney[.]shop

fortnitemoney.shop is currently active and resolves to the IPv4 address 158.94.211.169. The domain is hosted on DNSPod infrastructure, as indicated by its authoritative name servers a.dnspod.com, b.dnspod.com and c.dnspod.com. It appears on a single security blocklist and is explicitly listed by PhishDestroy, confirming its classification as a phishing vector. VirusTotal analysis shows that one out of ninety‑one scanning engines returned a positive detection, which, while a minority, aligns with the high‑risk rating assigned by the reporting team.

The presence on a blocklist and the detection by a reputable scanning engine demonstrate that the domain is being actively used for malicious purposes. No additional telemetry such as SSL certificates, HTTP response codes, or page titles is presently available, leaving the detailed content of the site unverified. Defenders should block network traffic to 158.94.211.169 and add fortnitemoney.shop to domain deny lists across perimeter, DNS, and endpoint controls.

Continuous monitoring of DNS queries for the three DNSPod name servers is advisable, as any change may indicate relocation of the malicious infrastructure. Organizations should also review email filtering rules for references to “Fortnite Money” to mitigate phishing attempts that may leverage this domain. Given the active status, high risk rating, and confirmed blocklist entry, the domain should be treated as a confirmed phishing threat until further evidence suggests remediation.