twezygame[.]xyz

Analysis of twezygame.xyz shows a recently registered domain created on March 22, 2026 that is currently taken offline. The domain resolves to the IP address 91.218.49.169, which is geolocated to Ukraine and is hosted by Virtual Systems LLC. The authoritative name servers are jill.theonionhost.com and ray.theonionhost.com, both of which are associated with the on‑demand hosting provider The Onion Host. Infrastructure fingerprints indicate the web server runs LiteSpeed with a PHP backend and serves client‑side libraries such as Bootstrap, jQuery, particles.js, and Google Hosted Libraries over HTTP/3. No TLS certificate is presented, meaning the site operates without encryption, a common characteristic of low‑cost phishing deployments.

The visible page title reads "Add Robux," linking the site to a gaming‑related scam that promises in‑game currency for Roblox users. VirusTotal has recorded 23 detections out of 94 scanned security vendors, confirming that a significant portion of the security community classifies the domain as malicious. It appears on a single public blocklist and has been explicitly blocked by PhishDestroy, while Gridinsoft assigns it a trust score of 0 out of 100, indicating a high confidence of abuse. The registrar listed for the domain is Dynadot LLC, a mainstream registrar often used by threat actors to obtain short‑lived domains.

Because the site is offline, real‑time content inspection is unavailable, and no Safe Browsing or Open Threat Exchange signals are provided in the supplied intelligence. Defenders should continue to block the domain and its associated IP address, monitor for any re‑hosting under the same name servers, and consider adding the IP to network‑level deny lists. Further investigation should focus on any residual DNS records, potential subdomains, and the hosting provider's abuse contact to request takedown if the site reappears.