fortmove[.]top

fortmove.top was registered on April 24, 2026 through Global Domain Group LLC and immediately pointed to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States. The domain resolves via the Cloudflare name servers kallie.ns.cloudflare.com and peter.ns.cloudflare.com and serves a site protected with a Let's Encrypt certificate (issuer YE1). A page title retrieved from the live endpoint reads “Fortnite Inventory Checker | Epic Games”, indicating an attempt to impersonate Epic Games services. The page is built with Tailwind CSS and leverages Cloudflare Browser Insights and HTTP/3, consistent with the underlying Cloudflare infrastructure.

VirusTotal has indexed the domain and 7 of 91 scanning engines returned a positive detection, confirming malicious classification. Independent security feeds have added fortmove.top to at least one blocklist, and PhishDestroy has explicitly blocked it. Gridinsoft’s trust scoring system assigned a rating of 0 out of 100, reflecting extreme risk. The domain is currently taken offline, so active content cannot be inspected further, and the exact payload or credential‑capture mechanisms remain unknown.

Given the evidence, analysts should continue to monitor the domain’s DNS and certificate changes, add the IPv6 address and associated netblock to internal deny lists, and propagate the blocklist entries to email and web gateway filters. Because the site mimics an Epic Games inventory tool, organizations that manage Epic Games accounts should alert users to verify URLs and avoid entering credentials on untrusted domains. Threat‑intel sharing platforms should be updated with the registration, hosting, and detection data to improve collective detection of similar brand‑impersonation campaigns.