win-roblxs[.]blogspot[.]com

This domain, win-roblxs.blogspot.com, is under investigation for generic phishing activity, specifically targeting users through a fake login interface designed to steal credentials. The domain mimics legitimate Roblox-related services, luring victims into entering sensitive account information. Analysis indicates the site is hosted on Google’s Blogger platform, leveraging trusted infrastructure to evade initial suspicion. The threat is classified as a credential harvesting operation, with no evidence of malware distribution or crypto drainer functionality at this time.

Technical evidence confirms the domain resolves to IP address 142.251.14.132, which belongs to Google LLC. VirusTotal analysis shows 0 out of 95 security vendors have flagged this domain, indicating it has not yet been widely detected by threat intelligence feeds. The SSL certificate is issued by Google Trust Services, and the domain remains active as of the latest check. No blocklist data is available for this domain, but its creation date and registrar details are tied to Google’s infrastructure, typical of Blogger-hosted phishing sites. The unique seed 97a494 is associated with this investigation.

Users who have visited win-roblxs.blogspot.com should immediately change any passwords entered on the site and enable two-factor authentication on their Roblox accounts. It is also recommended to scan the device for any unauthorized software or browser extensions. Avoid revisiting the domain and report it to Google Safe Browsing. Monitoring for unusual account activity over the next 30 days is advised, as stolen credentials may be used in subsequent attacks.