fortup[.]live

This domain, fortup.live, is flagged as a generic phishing resource targeting users of the popular gaming platform Fortnite, operated by Epic Games. Analysis indicates the site masquerades as a "Fortnite Wealth Leaderboard," a fabricated feature designed to lure victims into entering sensitive account credentials. The page employs Tailwind CSS for styling and is proxied through Cloudflare, which may obscure the true origin of the malicious infrastructure. No explicit cryptocurrency drainer kit signatures were detected, though credential harvesting remains the primary objective. Infrastructure analysis reveals the domain was registered on May 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.166.144, a Cloudflare-operated endpoint. Detection metrics show 15 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse. Google Safe Browsing status was not explicitly provided, but the elevated detection rate suggests active malicious classification. As of the latest assessment, fortup.live has been taken offline, likely following abuse reports or automated takedown procedures. Despite its current inactive status, residual risk persists due to potential credential exposure from prior interactions. Users who accessed the domain are advised to rotate any entered credentials immediately and enable multi-factor authentication on associated accounts. Organizations should monitor network logs for connections to 172.67.166.144 and the domain itself to identify compromised endpoints. The use of Cloudflare infrastructure complicates attribution but underscores the need for layered defensive measures against phishing campaigns leveraging content delivery networks.