Known malicious kitcriticalphishing

Fortnite "locker value" checkers: fake "Log in with Epic" page behind a shape-order captcha

family: fortnite-locker-epic-login-kit-2026-10

Fake Fortnite "locker value" and "inventory checker" sites that offer to price a player's skins, emotes and V-Bucks, then send the visitor to a look-alike Epic Games sign-in page on the same site (/id/login) to take over the account. Every site sits behind a home-made captcha ("Tap the targets": click four noisy shapes in a set order) that fingerprints the browser and turns away automated visitors, so most scanners only ever see a page titled "Loading"; some crawlers that pass are shown a plain-text "free locker checker" decoy instead. More than 100 look-alike names built from fort-, fn-, locker-, vbucks- and epic- (for example epic-price[.]com, fortnite-scan[.]com, lockercheck[.]net, zyntara[.]top) have gone live since 2026-10-13, all served from one server (193.187.110[.]10), which also hosts Valorant, casino and payment-card themed lures. A match means a scan of one of these hosts or of that server.

Anchors

SMQL queryrun
ip:193.187.110.10 OR tracking_id:DB8LFB3C77U6POU9AAHG OR contacted_host:epic-price.com OR contacted_host:fortdrim.com OR contacted_host:zyntara.top OR contacted_host:fortnite-scan.com OR contacted_host:lockercheck.net OR contacted_host:lockerstat.com OR contacted_host:mylocker.live OR contacted_host:fortcheck.ink OR contacted_host:fortvite.com OR contacted_host:epicfort.cv OR contacted_host:fortmetric.cc OR contacted_host:fngrab.com OR contacted_host:fortshop.top OR contacted_host:ulockergg.top OR contacted_host:fortnite-swap.com OR contacted_host:epic-loadout.best OR contacted_host:vbucksrate.com

Provenance

Added: 2026-10-20 19:40
One hunt for the kit. The captcha gate keeps its strings in one large encrypted inline script, sends a browser fingerprint to /.rt/ce, verifies the puzzle at /.rt/captcha/verify and only then lets the visitor through; its error messages are written in Russian and English. The lure page itself loads /libs/sg-min.js and /.rt/captcha-handler.js, plants hidden trap form fields that report to /___trap, and carries the TikTok pixel DB8LFB3C77U6POU9AAHG. Search anchor: that server, the pixel and the newest hosts. Names rotate daily, so the server and the pixel are the parts that last.

Sightings (15)Atom feed

HostScanScriptMatchScanned
fflux.top582205fd…—query2026-10-20 20:29
zyntara.top57a48a02…—query2026-10-20 19:30
fortreq.come2c9b480…—query2026-10-20 12:12
forthez.com91dc3c09…—query2026-10-19 09:29
fortzone.me0ec95923…—query2026-10-19 00:19
fortelyna.com5d446281…—query2026-10-18 22:41
fninv.comf39a65fd…—query2026-10-18 15:21
fn-skins.com5a412c41…—query2026-10-18 13:44
fortgop.comf1ebaa34…—query2026-10-17 18:56
fnlooker.coma466526b…—query2026-10-17 13:09
fortvaluers.com71b6fd09…—query2026-10-17 01:03
fortnuz.coma26ee073…—query2026-10-16 03:02
fn-og.com14229951…—query2026-10-14 21:40
fortnor.tope22a4619…—query2026-10-14 00:35
fnlocker.myb228dc96…—query2026-10-13 22:51