roblox[.]gs

This domain, roblox.gs, is actively flagged as a high-risk brand-impersonation threat targeting Roblox users. Infrastructure analysis reveals the domain was registered on July 16, 2025, through Atlantis North Ltd, a registrar frequently associated with phishing operations. The site resolves to IP address 91.231.222.76 and employs Nginx as its web server, alongside Bootstrap for frontend design and HSTS for enforced HTTPS connections. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. The page title, 'Catalog - Roblox,' directly mirrors Roblox's official branding, indicating an intent to deceive users into believing the site is an authentic Roblox platform. This domain appears on seven security blocklists, including PhishingArmy, PhishDestroy, and OISD, and is referenced in 50 threat intelligence pulses on AlienVault OTX. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While 21 of 95 security vendors on VirusTotal flag the domain, the absence of a full scan does not imply safety—only that some vendors have not yet assessed it. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should treat this domain as a confirmed phishing resource and block it at the DNS or network level. Additional monitoring of the IP address 91.231.222.76 may reveal related infrastructure used in similar campaigns. The exact content or functionality of the site has not been analyzed, but the combination of brand impersonation, blocklist presence, and threat intelligence references provides sufficient evidence for immediate action.