rblxprofile[.]com

rblxprofile.com was registered on April 30, 2026 through the registrar Spaceship, Inc. The domain is delegated to Cloudflare’s authoritative name servers bradley.ns.cloudflare.com and liv.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The domain resolves to the IP address 104.21.61.203, which belongs to Cloudflare, Inc. and is geolocated to Canada. The HTTP response code returned for the root URL is 200, confirming that a web server is actively serving content.

The site presents a TLS certificate issued by Let’s Encrypt, identified as the “E7” issuance profile. The certificate is valid and was likely obtained automatically, a pattern common among malicious actors leveraging free certificates to gain user trust. The presence of a valid certificate combined with a 200 response suggests the infrastructure is fully operational and intended for public interaction.

Threat intelligence sources have classified rblxprofile.com as a generic phishing site. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy blocklist. VirusTotal scans have resulted in 14 out of 95 security vendors flagging the domain as malicious, reflecting a moderate to high level of consensus among detection engines. Additionally, Gridinsoft assigns a trust score of 0 out of 100, indicating the highest possible risk rating from that assessment platform.

While the current evidence confirms active phishing infrastructure, the specific lures, credential harvesting pages, and targeted brand associations have not been publicly disclosed. Defenders should include the domain and its resolved IP address in outbound and inbound filtering rules, monitor DNS queries to the associated Cloudflare name servers, and enforce TLS inspection where permissible to detect malicious payloads. Continuous re‑evaluation of the domain’s status on blocklists and periodic re‑scanning with multi‑engine services are advised to capture any evolution of the threat.