fortws[.]lol

This domain, fortws.lol, poses a credential harvesting threat by impersonating Epic Games' Fortnite platform through a fraudulent inventory checker page. The site mimics legitimate Epic Games branding, targeting users seeking in-game item verification or account access. Analysis of the page title, 'Fortnite Inventory Checker | Epic Games,' confirms the intent to deceive users into entering sensitive account credentials, which are then exfiltrated to malicious actors. Infrastructure analysis reveals the domain was registered on April 17, 2026, through Global Domain Group LLC, with a Gridinsoft trust score of 0/100. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The domain resolves to IP address 172.67.185.181, utilizing Cloudflare for hosting and HTTP/3 for communication, which may obscure detection efforts. Technologies detected include Tailwind CSS for styling and Cloudflare Browser Insights for analytics, suggesting an attempt to appear legitimate while monitoring user interactions. Users who visited fortws.lol should immediately revoke any entered credentials and enable multi-factor authentication on their Epic Games accounts. Monitor linked payment methods for unauthorized transactions, as compromised accounts may be used for fraudulent purchases. Security teams should block the domain and its resolving IP (172.67.185.181) at the network level, and conduct a review of endpoint logs for connections to the domain or related indicators. Given the elevated risk level and offline status, remain vigilant for similar impersonation attempts targeting gaming platforms.