fortstash[.]lol

This domain, fortstash.lol, operates as a brand impersonation scam specifically targeting users of Epic Games' Fortnite. The site presents itself as an official "Fortnite Wealth Leaderboard," a fabricated feature designed to deceive players into believing they are interacting with legitimate Epic Games infrastructure. The primary threat involves credential harvesting or the distribution of malicious payloads, likely under the guise of exclusive in-game rewards or account verification. Given the domain's association with Fortnite, a globally popular gaming platform, the potential victim pool is substantial, increasing the risk of widespread account compromise or financial fraud for those who engage with the site. Analysis of fortstash.lol reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 17 out of 95 security vendors on VirusTotal, a significant detection rate for a phishing domain. It was registered on May 9, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.97.3 and appears on at least one security blocklist. Additional infrastructure analysis indicates the use of Cloudflare, Tailwind CSS, and HTTP/3, technologies commonly employed to obfuscate malicious activity and enhance the site's perceived legitimacy. The domain's trust score is 0/100, further corroborating its fraudulent nature. Users who visited fortstash.lol should take immediate remedial actions to mitigate potential risks. If any credentials were entered, those passwords must be changed across all platforms where they were reused, prioritizing Epic Games accounts. Devices used to access the site should undergo a thorough scan for malware or unauthorized software installations. Enable multi-factor authentication (MFA) on all critical accounts, particularly gaming and financial platforms. Monitor account activity for unauthorized transactions or changes, and report any suspicious behavior to the affected service provider. Given the domain's offline status, users should remain vigilant for similar scams, as threat actors often rotate infrastructure to evade detection.