roblox[.]com[.]bz

Analysis indicates that the domain roblox.com.bz is actively impersonating the Roblox brand as of July 12, 2026. Infrastructure data reveals the domain resolves to 91.240.20.15, an address hosted on AS59939 (WIBO Baltic UAB) in the Netherlands. The site is currently delivering a 301 HTTP redirect, suggesting it may be part of a larger redirection chain or staging infrastructure. Detected technologies include Apache HTTP Server, Cloudflare, and Tailwind CSS, alongside third-party libraries such as jsDelivr and crypto-js, which are commonly observed in credential harvesting kits. The domain was registered on July 8, 2021, and has been flagged by two security blocklists, including PhishDestroy and DiscordPhishing. A total of 20 out of 91 security vendors on VirusTotal classify this domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and fraudulent sites. The page title 'Immortal' does not align with typical Roblox branding, which may indicate an attempt to evade automated detection or suggest the site is part of a broader phishing campaign rather than a direct clone. Defenders should treat this domain as high-risk infrastructure. Network-level blocking is recommended, particularly for environments frequented by younger users or gaming communities. Given its presence in nine AlienVault OTX threat intelligence pulses, this domain has been linked to multiple malicious campaigns, reinforcing its role in ongoing credential theft operations. The exact nature of the phishing content remains unconfirmed, as the site has not been directly analyzed, but the combination of brand impersonation, active blocklist flags, and long-standing domain registration suggests a deliberate and persistent threat.