fortniteaim[.]com

PhishDestroy identifies fortniteaim.com as an active credential theft domain posing as the popular game Fortnite to steal user login details. This domain was flagged by 5 out of 95 VirusTotal security vendors, indicating elevated risk. Registered through TUCOWS.COM on February 19, 2024, the site resolves to IP 5.187.4.134 and is blocked by Maltrail, with a Let’s Encrypt SSL certificate providing false legitimacy. The domain’s recent creation and inconsistent detection rates suggest it is part of a rapidly evolving campaign targeting gamers. FortniteAim.com specifically mimics the Fortnite brand to deceive users into entering credentials on a spoofed login page. The domain’s threat classification as credential theft, rather than generic phishing, underscores the risk of direct account compromise. Evidence shows 5/95 security vendors flagged the domain, it was registered via TUCOWS.COM, and appeared on one security blocklist. The site’s SSL certificate is issued by Let’s Encrypt, a common tactic to bypass browser warnings, while the IP address 5.187.4.134 is linked to malicious infrastructure. Users who visited fortniteaim.com should immediately check their Fortnite accounts for unauthorized access, enable two-factor authentication if not already active, and change passwords used on the site. Scan devices for malware using reputable antivirus tools and avoid entering credentials on any unfamiliar or suspicious domains. Report the domain to your security team or platform provider to aid in takedown efforts and prevent further exploitation.