roblox[.]com[.]ki

The domain roblox.com.ki is identified as a high-risk generic phishing site, specifically designed to impersonate the Roblox brand. This domain is likely part of a broader campaign aimed at stealing user credentials or other sensitive information from unsuspecting visitors. The threat leverages a deceptive URL structure to mimic the legitimate Roblox website, potentially leading users to believe they are interacting with a trusted service.

Analysis indicates that the domain is flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection among security services. The domain is registered with Let's Encrypt, which provides a free SSL certificate (E8). It resolves to the IP address 91.240.21.6, located in Germany and associated with Hooray Solutions Corp. The domain was created on April 27, 2026, and has been flagged by Google Safe Browsing as a phishing site. Additionally, the domain appears on one security blocklist, further confirming its malicious intent.

The domain is currently offline, indicating that it has been taken down or is no longer actively hosted. Despite this, the infrastructure remains a potential threat as it could be reactivated. It is recommended that users who may have interacted with this domain monitor their accounts for any unauthorized activity and change their passwords immediately. Security teams should continue to monitor the domain and associated IP for any signs of reactivation and take appropriate measures to protect users.