bloxfruitsvault[.]com

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of the Roblox gaming platform. The page title, 'Free Blox Fruits - Roblox,' directly mimics legitimate in-game content, increasing the likelihood of user engagement through social engineering tactics. Analysis indicates the domain was specifically crafted to exploit the popularity of Roblox's Blox Fruits game, despite being incorrectly associated with Blizzard in threat intelligence reports. Infrastructure analysis reveals the domain bloxfruitsvault.com was registered on May 30, 2025, through NameCheap, Inc., and resolved to the IP address 74.50.89.209 (AS19318, Interserver, Inc., US). VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists: PhishDestroy and PhishingDB. No SSL certificate was detected, further reducing its legitimacy. The domain has since been taken offline, though historical resolution data remains a relevant indicator for retrospective threat hunting. Mitigation steps for this brand impersonation threat include blocking the domain and its associated IP (74.50.89.209) at the network perimeter. Security teams should monitor for any residual DNS queries or attempts to resolve the domain, as these may indicate compromised endpoints. User awareness training should emphasize the risks of engaging with unofficial gaming reward sites, particularly those offering 'free' in-game items. Additionally, organizations should review logs for any connections to the IP or domain within the past 30 days to identify potential prior exposure.