fortniteinv[.]live

This domain, fortniteinv.live, is identified as a phishing resource impersonating Epic Games to harvest user credentials through a fraudulent Fortnite inventory checker interface. Analysis indicates the page title explicitly mimics legitimate Epic Games branding, presenting itself as 'Fortnite Inventory Checker | Epic Games' to deceive users into entering login credentials. No direct evidence of a crypto drainer kit or payment skimmer was observed, though credential theft remains the primary objective. The domain targets users of the popular gaming platform, leveraging social engineering tactics to exploit trust in the brand. Infrastructure analysis reveals the domain was registered on April 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 104.21.23.178, which is part of a content delivery network known for obfuscating underlying hosting infrastructure. Detection metrics show 22 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The domain is referenced in one threat intelligence pulse on AlienVault OTX, and Gridinsoft assigns it a trust score of 1 out of 100. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or intermittent detection. As of the latest assessment, fortniteinv.live has been taken offline, likely in response to security vendor detections or hosting provider intervention. The domain was blocked by at least one security service, and technologies such as Tailwind CSS and Cloudflare were detected, suggesting a structured phishing kit deployment. Despite its current offline status, the domain remains a residual risk due to potential re-registration or migration to alternative infrastructure. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on gaming accounts, and report any suspicious login prompts to the legitimate platform provider.