bbgamesrblx[.]click

Analysis of bbgamesrblx.click indicates that the domain was registered through Dynadot LLC on March 06, 2026. The domain resolves to IP 91.218.49.169, which is allocated to AS6698 Virtual Systems LLC and geolocated to Ukraine. No TLS certificate is presented, meaning any HTTP traffic would be transmitted in clear text. The authoritative nameservers are jill.theonionhost.com and ray.theonionhost.com, both appearing to be operated by the same hosting provider. The only visible artifact is the page title “Add Robux”, which suggests an attempt to lure users seeking Robux, the virtual currency for the Roblox platform.

The domain appears on one security blocklist and has been flagged by a single vendor on VirusTotal out of 95 scans, indicating that at least one security product identified it as malicious. PhishDestroy has taken the domain offline, and the current status is reported as offline. The threat is classified with an elevated risk level. The evidence points to a classic phishing infrastructure: a recently created domain, lack of TLS, and hosting on a provider frequently used for malicious sites. However, the limited detection footprint—only one blocklist entry and a single VirusTotal flag—leaves uncertainty about the scale of distribution, the specific phishing kit employed, and whether the site ever served live content before takedown.

No additional intelligence such as Safe Browsing status, OTX mentions, or detailed payload analysis is available. Defenders should block outbound connections to 91.218.49.169 and add bbgamesrblx.click to domain blocklists. Email filters should be tuned to flag messages containing the “Add Robux” phrase or links to this domain. Monitoring of DNS queries for the domain’s nameservers may reveal related campaigns. Although the site is offline, the underlying infrastructure could be repurposed for future campaigns, so continued vigilance and user education about unsolicited Robux offers are recommended.