lenong99[.]com

This domain is flagged for elevated risk due to confirmed credential theft activity targeting Roblox users. Analysis indicates the site employs social engineering tactics, masquerading as a gaming rewards platform to harvest login credentials, payment details, and personal information under the guise of "challenging creativity" with Roblox. The infrastructure aligns with credential theft operations, not generic phishing, given its focus on a specific gaming brand and user account compromise techniques. Infrastructure analysis reveals the domain lenong99.com was registered on October 11, 2025, through NameSilo, LLC, and resolves to IP address 38.60.191.229, hosted on AS138915 (Kaopu Cloud HK Limited). The domain appears on one security blocklist and is flagged by 18 of 95 security vendors on VirusTotal. The page title, "LENONG99 : LENONG 99 Tantang Kreativitasmu Dengan Roblox," explicitly references Roblox, a key indicator of brand-specific credential theft. The domain was subsequently taken offline, though prior exposure remains a risk for users who interacted with it. Mitigation steps for credential theft exposure include immediate password resets for any Roblox or associated accounts accessed during the domain's active period. Users should enable multi-factor authentication (MFA) on all gaming and financial platforms to prevent unauthorized access. Network-level protections, such as DNS filtering or endpoint detection rules, should block the domain and its resolving IP (38.60.191.229) to prevent re-exposure. Organizations should monitor for credential reuse across corporate systems, as stolen gaming credentials are frequently repurposed for broader account takeovers. Historical interactions with the domain should be treated as compromised, warranting a review of linked payment methods and secondary accounts.