fortvem[.]com

Analysis of the domain fortvem.com indicates a targeted brand impersonation campaign against Epic Games, specifically leveraging the Fortnite brand. The domain was registered on February 21, 2026, and resolves to the IP address 104.21.9.142, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The page title, 'Check the value of your inventory - Fortnite,' directly references Fortnite, reinforcing the intent to deceive users into believing the site is affiliated with Epic Games. As of July 22, 2026, the domain is offline, though its prior activity and infrastructure warrant continued scrutiny. Infrastructure analysis reveals the use of Cloudflare hosting, a common tactic to obscure the true origin of phishing sites and evade takedowns.

The SSL certificate is issued by WE1, a provider frequently observed in low-reputation or malicious domains. Detection data is limited but notable: one of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on a single security blocklist, with PhishDestroy explicitly blocking it. The scam type is classified as a gaming scam, aligning with the observed brand impersonation. Defenders should treat this domain as a confirmed phishing threat, particularly for users of Epic Games or Fortnite.

While the site is currently offline, its registration date and hosting choices suggest it may resurface or be part of a broader campaign. Monitoring for re-activation or related domains using similar naming conventions (e.g., 'fort' prefixes) is recommended. If encountered in logs or proxy data, the domain should be blocked at the network level, and any associated credentials or user interactions should be investigated for compromise. The limited detection coverage underscores the need for layered defenses, including endpoint protection and user education on gaming-related scams.