robllllrey[.]netlify[.]app

This domain was observed delivering a brand‑impersonation page titled “Get robux” that claims to provide Roblox virtual currency. The domain robllllrey.netlify.app was registered on 2025-07-02 and resolves to the IPv6 address 2a05:d014:58f:6200::259, which is geolocated in Germany and belongs to ASN16509, an Amazon.com, Inc. network. HTTP requests return status 200 over TLS; the certificate is signed by a trusted authority and includes HSTS. Google Safe Browsing marks the site with a SOCIAL_ENGINEERING warning, and 18 of 95 VirusTotal scanners flag it as malicious. The domain appears on two public blocklists and is blocked by PhishDestroy and PhishingDB. The infrastructure indicates use of a generic hosting platform and standard web technologies. The risk rating is high and the campaign remains active. Uncertainty remains regarding the full payload delivered after the initial page load, as no additional content has been publicly disclosed. Defenders should block the domain at the network perimeter, update URL filtering, and monitor for related indicators such as the IPv6 address and the observed page title. Continuous observation is recommended to capture any evolution of the campaign.