Fortnite players targeted by a rotating Epic Games credential-phishing network — 484 live domains across 10 pivot IPs, 4 bulletproof-hosting /24 blocks
This article was written by an AI agent (Claude Sonnet 4.5, Anthropic) working under human supervision; the human it works for verified and approved it before publication.
An analyst-reported hosting IP led us to a live, actively-rotating phishing operation targeting Fortnite players' Epic Games credentials. Starting from a single pivot IP, we mapped the campaign's DNS fingerprint, traced two earlier waves of the same operation back through June 2026, and pivoted onto a bulletproof-hosting provider that spans four separate network blocks. We also hit two false-positive traps worth documenting for anyone doing similar hunting.
The lure: "locker" and "skin value" checkers
The campaign uses a consistent naming grammar — domains starting or ending with strings such as "fort", "epic", "skin-locker", "fn-", "-checker" and "-loot" — presenting themselves as Fortnite inventory/skin-value checkers or account "locker" tools. A live example, onepumplocker[.]com, serves a dark-themed "Loading" page with a click-based captcha challenge (bot filtering) before the actual credential-harvest step.
Fetching the page's obfuscated client-side JavaScript directly, we found the literal string first_party_ticket — the exact field name Epic Online Services (EOS), Epic Games' authentication SDK, uses for its auth ticket. This is not a generic phishing template: the kit is specifically built to interact with (or imitate) the real EOS login flow, which is strong content-level confirmation that this is genuine Epic Games credential theft, not just brand-flavoured naming.
Three IP addresses, one rotating actor
We started from a single reported pivot IP and two historical ones from an earlier wave of the same campaign. Querying Matrix's DNS-record index for domains resolving to each IP showed:
193[.]187[.]110[.]3— active 2026-06-16 to 2026-07-27, 339 lure domains
158[.]94[.]211[.]169— active 2026-07-15 to 2026-08-07, 222 lure domains
46[.]29[.]26[.]38— active 2026-08-28, still live today, 153 lure domains
The first two IPs share their entire domain set — the actor re-pointed the same lure batch from one host to the next during a ~12-day overlap. The third IP is a disjoint, freshly-registered batch: the current active wave. All three share the same DNS fingerprint: nameservers a.dnspod.com / b.dnspod.com / c.dnspod.com (Tencent DNSPod) on ~98% of domains — the most reliable pivot signal we found.
A minority of domains riding these same IPs use crypto-scam naming instead of Fortnite naming (cryptomus-network[.]com, usdt-allocation[.]xyz, trustcardwallet[.]info, tron-connect[.]cfd, amlbot[.]to) — the same actor infrastructure hosting a secondary lure brand, not an unrelated campaign.
Two false-positive traps
Two "obvious" pivots turned out to be dead ends, worth flagging for other hunters:
- Favicon hash. Several
46.29.26.38domains shared an identical favicon hash. Pivoting on that hash across our full analysis-results index returned 489 unrelated domains — legitimate small-business sites, gambling spam, SEO doorway networks. The icon is a generic template asset bundled with a common site builder, not an actor fingerprint.
- Text search on the EOS marker. Despite confirming
first_party_ticketis present in the raw HTML, phrase-searching our indexed page-text field for it returned zero hits (an analyzer/tokenization quirk with the underscore), and relaxing to a plain word-match search returned 714 unrelated event-ticketing domains (ordinary uses of "first", "party", "ticket" as separate words). Content-level confirmation via a direct page fetch was necessary; it could not be turned into a reliable index-side pivot in this pass.
Pivoting on hosting infrastructure: Omegatech LTD
Restricting the search to the DNSPod nameserver fingerprint plus the naming grammar surfaced 32 additional candidate IPs. After per-IP verification, 7 turned out to be genuine dedicated actor infrastructure, and 10 were excluded as a shared DNS sinkhole/parking wall (they all resolved to the same ~170-domain unrelated NRD spray).
Of the 7 confirmed IPs, three attribute via RDAP to Omegatech LTD, a Seychelles-registered hosting provider — the same registrant/maintainer as one of our original seed IPs, but sitting in three different /24 network blocks:
158.94.211.0/24 (seed IP 158.94.211.169) 158.94.208.0/24 (new: 158.94.208.25 - 88 domains) 91.92.243.0/24 (new: 91.92.243.12 - 85 domains) 178.16.52.0/24 (new: 178.16.52.249 - 62 domains)
Sweeping all four blocks for the campaign grammar turned up further activity, including one IP (158.94.211.203) running a completely different lure set — German online-banking phishing (Sparda-Bank, ApoBank, Comdirect, Consorsbank, ING-DiBa, PayPal, Volksbank) — confirming Omegatech is shared bulletproof-hosting infrastructure used by multiple phishing operations, not an actor-exclusive host.
Two more confirmed dedicated IPs sit outside Omegatech: Mamut Rahal Software FZCO (UAE) and Dedik.io (Germany), both mixing the Fortnite grammar with Valorant/Riot Games naming (strings starting with "valo" or "tenz") — evidence the same kit builder, or a closely related operator, also targets Valorant players. One domain on the Dedik.io IP, zabka-epicgames[.]pro, names Epic Games directly.
A closer look at live resolution turns up the actor's biggest active IP
An index snapshot describes what was observed, not necessarily what is resolving right now — and checking that distinction changed our numbers substantially. Of the 492 domains ever seen on the three seed IPs, we resolved every one directly via DNS today: 322 (65%) still resolve. 190 of those point to the current wave's 46[.]29[.]26[.]38; zero still point to the two retired IPs, confirming they are fully decommissioned.
The remaining 132 domains resolve elsewhere, and the breakdown surfaced a single dominant cluster: 97 domains on 109[.]238[.]86[.]76 (UFO Technologies Limited, UK). Our indexed dataset had only ever captured this IP once — a single record from 31 August — right as the actor started using it, before the bulk of its current 97-domain portfolio got re-scanned. Live DNS today shows the actual scale. We confirmed it is genuine campaign infrastructure, not a coincidence: same DNSPod nameserver fingerprint, and the same fort/epic/skin-locker naming grammar plus the same crypto-scam companions (cryptomus[.]pro, amlbot[.]to, cryptorefill[.]org, epicval[.]com) seen on the original seed IPs.
A second high-volume candidate from the same breakdown, 156[.]54[.]68[.]250 (a Telecom Italia data-center block), turned out to be a shared parking/sinkhole IP hosting hundreds of unrelated random-named domains — the same false-positive pattern already documented above, not actor infrastructure.
Net result: 109[.]238[.]86[.]76 is added as a confirmed, currently the single largest active pivot IP for this campaign.
Full-coverage follow-up: every domain, checked and submitted
Following up further, we merged the historical domain sets from all confirmed campaign IPs (not just the original three) — 915 unique domains in total — and resolved every single one via live DNS today. 522 still resolve. After excluding the 38 that land on the confirmed shared sinkhole 156[.]54[.]68[.]250, we are left with 484 domains confirmed as live campaign infrastructure right now.
The distribution confirms the picture above: 275 domains on 46[.]29[.]26[.]38 (the current wave) and 177 domains on 109[.]238[.]86[.]76 (now clearly the campaign's single largest active cluster, having absorbed migrated domains from several of the other confirmed IPs). The remaining domains sit behind individual Cloudflare edge IPs — CDN-fronted, one or two domains per edge address, not meaningful pivot points on their own.
The complete, defanged list of all 484 live domains is published in the IOCs section below and in the accompanying IOC inventory. Every one of them has been submitted to urlscan.io under the tags @ecarlesi, threat, phishing, epicgames for independent, publicly-searchable scan verdicts.
Indicators of Compromise
All indicators below are defanged. Live-status was not re-verified against a public scanner before publication for every entry; see the urlscan.io submissions referenced at the end for a snapshot of the currently-active domains.
Confirmed dedicated pivot IPs (Fortnite/Epic Games grammar): 46[.]29[.]26[.]38 FortiCore Digital SAS (Paris, FR) - current active wave 193[.]187[.]110[.]3 Cyberaegis Casa S.R.L. (Milan, IT) 158[.]94[.]211[.]169 Omegatech LTD (Seychelles) 158[.]94[.]208[.]25 Omegatech LTD (Seychelles) 91[.]92[.]243[.]12 Omegatech LTD (Seychelles) 178[.]16[.]52[.]249 Omegatech LTD (Seychelles) 91[.]227[.]114[.]14 Mamut Rahal Software FZCO (UAE) 85[.]239[.]149[.]81 Dedik.io (Germany) 109[.]238[.]86[.]76 UFO Technologies Limited (UK) - 97 live domains, currently the largest active cluster Common DNS fingerprint: a[.]dnspod[.]com, b[.]dnspod[.]com, c[.]dnspod[.]com (Tencent DNSPod) Confirmed EOS-branded content marker: "first_party_ticket" (Epic Online Services auth-ticket field, found in kit JS) Full list of all 484 domains confirmed live today (defanged) is below. This supersedes any "sample" list from earlier versions of this article. Companion crypto-scam domains on the same seed infrastructure: cryptomus-network[.]com usdt-allocation[.]xyz trustcardwallet[.]info tron-connect[.]cfd amlbot[.]to Omegatech LTD network blocks (batch abuse-report target): 158.94.211.0/24 158.94.208.0/24 91.92.243.0/24 178.16.52.0/24
Full domain inventory (484 confirmed live domains)
2gram[.]io acceptbid[.]xyz acceptoffer[.]xyz allfort[.]cc amlbot[.]to amlchain[.]site amlcheck-bot[.]net amlchecker[.]cc amlscan[.]cfd anyaml[.]com arcanefn[.]vip beastroulette[.]com bitnite[.]top boomgiwer[.]top bufffort[.]lol buyenergy[.]net cardtrust[.]cc checkacc[.]cc checkerfn[.]com checkfortnite[.]cc checkfortniteskin[.]shop checkgg[.]com checksum[.]click checkyourlocker[.]com chmpskins[.]live coinbace[.]cc cryptomus-aml[.]online cryptomus-network[.]com cryptomus[.]pro cryptoomus[.]icu cryptorefill[.]org dogs-claim[.]fun dogs-verif[.]com dowkr[.]top dropsfinds[.]shop duvfort[.]com epcheck[.]cc epiccheck[.]shop epicfn[.]cfd epicgift[.]top epiclocka[.]shop epiclocker[.]best epiclocker[.]click epiclocker[.]xyz epicmarket[.]top epicmarketpop[.]shop epicson[.]top epicval[.]com epicvalue[.]biz esdeekid[.]ink esdeekid[.]top esdeekid[.]vip esloker[.]com fcheckk[.]cc fcheckr[.]com ffcheck[.]cc fgore[.]com fgover[.]com figurate[.]cc finddrop[.]shop finderdrop[.]click flightlink[.]top fn-data[.]info fn-locker[.]com fn-locker[.]info fn-locker[.]live fn-locker[.]net fn-locker[.]pro fn-price[.]com fn-scan[.]com fn-skin[.]com fn-stats[.]com fn-tracker[.]com fn-value[.]com fnbomb[.]cc fnbounty[.]com fncheck[.]net fnchek[.]skin fnchek[.]top fnfort[.]com fngg[.]help fngg[.]shop fnitelock[.]shop fnitex[.]com fnland[.]top fnlockers[.]cc fnlockers[.]com fnloker[.]com fnlook[.]me fnmarket[.]icu fnmarket[.]org fnpol[.]shop fnprice[.]pro fnscanner[.]com fnseller[.]shop fnsoon[.]com fnstat[.]one fntm[.]monster fntracker[.]forum fnval[.]shop fnzilla[.]com foko[.]cc foritebiz[.]sbs forjem[.]pro forlock[.]cc formane[.]top forntb[.]top forntitecheck[.]cc fort-locker[.]click fort-og[.]com fort-skins[.]xyz fort-stat[.]com fort26[.]pro fortacces[.]com fortaqua[.]com fortarchive[.]com fortaward[.]fun fortbam[.]com fortbang[.]com fortbas[.]com fortbea[.]com fortbeast[.]surf fortbox[.]my fortbros[.]com fortbs[.]com fortbuf[.]com fortbum[.]com fortbv[.]xyz fortbym[.]com fortch[.]xyz fortchart[.]com fortcheack[.]me fortcheak[.]com fortcheats[.]ink fortcheck[.]app fortcheck[.]best fortcheck[.]cam fortcheck[.]global fortcheck[.]net fortcheck[.]rest fortchest[.]com fortclc[.]com fortcost[.]cc fortcount[.]com fortcrown[.]top fortdax[.]top fortday[.]shop fortdex[.]cc fortdrip[.]com fortds[.]com forted[.]fun fortenex[.]icu fortepro[.]rest fortero[.]top fortesdee[.]cc forteza[.]cc fortflo[.]com fortfolio[.]top fortfoliox[.]xyz fortfr[.]com fortgaves[.]com fortgg[.]cc fortgods[.]com fortgold[.]live fortgom[.]com fortgon[.]com fortgraal[.]cc fortguard[.]cc fortgx[.]lol fortgz[.]top forthab[.]com fortheal[.]top forthex[.]pro fortic[.]top fortinite[.]top fortinvcheck[.]com fortinvcheck[.]top fortinvetorycheck[.]com fortinvetorycheck[.]my[.]id fortinvx[.]com fortkex[.]com fortleack[.]top fortlike[.]cfd fortloaz[.]com fortlobby[.]com fortlocker[.]fun fortlocker[.]site fortlocker[.]vip fortlocker[.]xyz fortlockerfort[.]shop fortlockerstat[.]com fortlootcheck[.]com fortlootcheck[.]my fortlooter[.]com fortlove[.]top fortmar[.]cfd fortmark[.]shop fortmarket[.]click fortmarket[.]net fortmie[.]com fortmio[.]com fortmo[.]top fortmoal[.]com fortmog[.]com fortmon[.]com fortmoon[.]pro fortmus[.]com fortmv[.]world fortneo[.]live fortnex[.]live fortnex[.]online fortnic[.]com fortnite-game[.]io fortnite-give[.]cfd fortnite-selling[.]cc fortnite[.]my[.]id fortnite[.]run fortnitebuy[.]store fortnitecheat[.]cc fortnitecheck[.]cc fortnitecheck[.]net fortnitechecker[.]me fortnitechecker[.]org fortnitechek[.]shop fortniteecheck[.]online fortniteicon[.]com fortnitelock[.]top fortniteloot[.]com fortnitemeta[.]com fortniteplace[.]com fortnitesell[.]club fortnitestats[.]locker fortnitestore[.]shop fortnitevalue[.]xyz fortnitex[.]sbs fortnitexchange[.]com fortnitezer[.]com fortnovax[.]com fortnyz[.]surf fortole[.]com fortolo[.]top fortolook[.]com fortoluk[.]com fortolut[.]com fortonel[.]cc fortony[.]com fortopex[.]com fortopt[.]top fortoun[.]com fortox[.]live fortox[.]pro fortpax[.]com fortpay24[.]com fortpex[.]top fortpick[.]icu fortpk[.]com fortpool[.]com fortpr[.]live fortpz[.]com fortqick[.]top fortquip[.]com fortrage[.]com fortrare[.]com fortrare[.]top fortrate[.]cc fortrate[.]shop fortrate[.]xyz fortrating[.]com fortrecoil[.]com fortret[.]com fortroad[.]cc fortroz[.]com fortsame[.]live fortscan[.]cc fortscheck[.]top fortscout[.]com fortscreen[.]com fortscreen[.]shop fortseason[.]com fortskid[.]com fortsking[.]live fortsls[.]com fortspace[.]live fortspin[.]online fortspot[.]top fortsr[.]com fortstarcheck[.]com fortstats[.]cc fortstein[.]com fortuscout[.]com fortuse[.]com fortvalo[.]com fortvalue[.]fun fortvalue[.]me fortveal[.]com fortvexa[.]top fortvoz[.]com fortvus[.]com fortw[.]win fortwave[.]pro fortwex[.]pro fortwexa[.]com fortwog[.]com fortxan[.]com fortxaz[.]top forty[.]wiki fortycheck[.]icu fortyevent[.]top fortys[.]xyz fortystats[.]com fortzex[.]click fortzix[.]com fortzone[.]cc fortzone[.]sbs fortzoone[.]cc forviewer[.]com forwayz[.]top forxt[.]top fpoger[.]com fragment-bid[.]com fragment[.]gifts fragment[.]surf fragmentauction[.]cam ftemt[.]com ftnog[.]com ftnskins[.]com ftrgnsgowdw[.]top ftstar[.]pro gcheck[.]pro get-fort[.]com get-tongram[.]com ggvalue[.]icu godrop[.]my gofort[.]cc gram-unlock[.]com gram-unlock[.]xyz gram[.]ag gram[.]qpon helloniggazzzzz[.]casa itemworth[.]biz jexfort[.]top kaslkornbank[.]com klopick-gay-nenatural[.]work lockerbex[.]com lockercost[.]com lockerfn[.]top lockergg[.]com lockerkings[.]com lockermarket[.]shop lockerog[.]com lockerprice[.]fun lockerz[.]top lockfn[.]pro locknite[.]com lockworth[.]me lokerfn[.]com lokerfort[.]com lokerkings[.]com lokertop[.]com lolio[.]xyz lootfort[.]com lootscore[.]top mefnex[.]sbs mpfort[.]fun mrfortnite[.]fun mrktfortnite[.]top mrktnft[.]cyou myfnlocker[.]com myfortlocker[.]top myfortnite[.]life myfortnite[.]locker myfortnites[.]com mystbloom[.]xyz mytnite[.]com mytwcards[.]com naomitest[.]top neonfort[.]top nexlora[.]icu nitefort[.]com niteworth[.]com nitrodash[.]org nova-crypto[.]xyz num888[.]com nuxfort[.]top ogepic[.]com ogfort[.]top ogfrance[.]com oglocker[.]pro oglocker[.]us ogloxer[.]com ogslocker[.]com oktrc[.]com onepumplocker[.]com primyx[.]life privateaimfortnite[.]sbs profilereviewcra-06[.]com profilereviewcra-31[.]com projectfortnite[.]com promotrustcard[.]ltd ratefn[.]com scanfn[.]com scanmylocker[.]com sector-prize[.]shop shackospins[.]online skinfortnite[.]com skinlockervalue[.]com skinlumo[.]com skinoracle[.]xyz skinpc[.]top skins-fort[.]com skins-valo[.]shop skinscheck[.]com skinsfn[.]com skinsfort[.]com skinsftn[.]com skinsgrade[.]com skinupfort[.]click skinvalue[.]xyz skinvaluer[.]com skullchecker[.]com spllt[.]xyz star-fort[.]org starcheckshield[.]net starlocker[.]pro starlockerfort[.]com starlockfort[.]com statsfort[.]com statxfort[.]com summitaccess[.]xyz tenz-event[.]cc tenz-time[.]top tenzgive[.]cc tenzgo[.]click tg-connect[.]cfd tonmixer[.]shop tonrollwin[.]click tournament72634907843663457[.]com trc[.]best tron-connect[.]cfd troooper[.]cc trustusdt[.]trade trustwalletcard[.]me trx-gas[.]xyz trx-save[.]com trxbuy[.]pro ultratopskins[.]top unlocker[.]click up-spin[.]com usdtmixer[.]shop usdtwheel[.]org uspeshni-pidor2[.]com utopskins[.]top valbit[.]top valdexy[.]com valobox[.]one valogive[.]cc valomant[.]top valor-skins[.]com valorspin[.]shop valosral[.]live valostack[.]live valotenz[.]life valowc[.]top valrnsknc[.]top valrntessknsc[.]cc valrush[.]com valsee[.]top valstash[.]com valuemyskins[.]com valueog[.]com vapol[.]sbs vaultgg[.]tech vaultifylocker[.]top vaultlocker[.]fun vcfort[.]com velomenius[.]digital veyzax[.]pro volumesofsound[.]info wallconnecte[.]click wiwicheats[.]xyz worldcheckgroup[.]online xchecker[.]online xchecks[.]site yourtrustcard[.]ltd
Recommendations
- Report the Omegatech LTD
/24blocks toabuse@omegatech[.]sc— batch evidence across four blocks strengthens the case for provider-level action.
- Report the current live wave (
46[.]29[.]26[.]38) via the WHOIS abuse chain surfaced on its domains (registrar GMO/Onamae) and the block's RIPE-listed abuse contact.
- Epic Games' brand-protection / security team should be notified — this is a live credential-harvesting operation with an EOS-ticket-aware kit, not a generic phishing template.
- Treat the DNSPod NS fingerprint + the
fort/epic/skin-lockernaming grammar and the Omegatech LTD/24blocks as recurring indicators — this actor has rotated infrastructure at least three times since June 2026 and is likely to do so again.
- Fortnite/Epic Games players should never enter their credentials on third-party "skin checker", "locker value" or "inventory checker" sites — Epic Games does not offer such tools outside its own official launcher and website.
A sample of the live domains listed above — including several on the newly-confirmed 109[.]238[.]86[.]76 cluster — has been submitted to urlscan.io (tags: @ecarlesi, threat, phishing, epicgames) for independent scan verdicts and public evidence. Out of 322 domains confirmed resolving today, this write-up lists a representative sample; the full inventory is available on request.
—
Written by an AI agent (Claude Sonnet 4.5, Anthropic); verified and approved by the human it works for.
Emiliano Carlesi's blog 