# PhishDestroy domain threat record: 90claim-free-robux-instant.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/90claim-free-robux-instant.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/90claim-free-robux-instant.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-13 12:37:05 UTC
- Last availability or vendor check: 2026-10-22 10:06:55 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 142.251.13.132
- Registrar in stored WHOIS data: Google Blogger
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b01d-2faa-73c8-aebd-d409050aceee/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/90claim-free-robux-instant.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.90claim-free-robux-instant.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://90claim-free-robux-instant.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This Blogger page, titled "Claim Robux", promises instant free Robux, the in-game currency of Roblox. Its audience is largely children and teenagers who want currency they cannot easily buy. PhishDestroy first flagged it on 2026-09-13 and classifies it as a gaming scam. On 2026-10-19 the site was still online with its content live.

How the scam works
Free Robux generators follow a familiar script. The page asks for a Roblox username, may show a fake progress bar or a counter of other "winners", and then requires one more step before the currency is "released". That step is usually entering the account password, completing "human verification" surveys or app installs that earn the operator money, or handing over personal details. No Robux is ever delivered. Victims can lose their Roblox account, along with its inventory and any linked payment method, or expose personal information to further scams.

Evidence
On 2026-09-19, VirusTotal showed 11 of 89 security engines flagging this address. The vendors were BitDefender, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky and Lionic. Recognition by eight independent vendors carries weight for a page on a shared Google platform, where reputation filters tend to be cautious. The domain appears on the PhishDestroy blocklist.

Infrastructure
The page is a free Blogger subdomain, so it is served from Google LLC infrastructure in the US. It uses the platform's standard certificate from Google Trust Services (WE2). Because every Blogger site gets HTTPS automatically, the padlock says nothing about whether this page is legitimate. Free hosting like this lets scammers launch pages at no cost and replace them quickly when one is removed.

What to do
If you typed your Roblox password here, change it right away and turn on two-step verification in Roblox settings. Then check for unfamiliar sessions, missing items or changed account email details. If the same password is used anywhere else, change it there too. Uninstall any app or browser extension the page told you to install. Parents should explain that Roblox never gives away Robux through outside websites. Defenders and school or family network administrators should block this subdomain and report it to Google's Blogger abuse channel so it can be taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b01d-2faa-73c8-aebd-d409050aceee/
VirusTotal report: https://www.virustotal.com/gui/domain/90claim-free-robux-instant.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=90claim-free-robux-instant.blogspot.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:47:29 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0b01d-2faa-73c8-aebd-d409050aceee.png
  Captured: 2026-09-13 12:37:05 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0b01d-2faa-73c8-aebd-d409050aceee.png
  Captured: 2026-09-22 03:30:38 UTC
  Source report: https://urlscan.io/result/01a0b01d-2faa-73c8-aebd-d409050aceee/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f5bade54-1352-40e5-81ed-e7f4d8b87791.png
  Captured: 2026-09-20 01:00:14 UTC
  Source report: https://radar.cloudflare.com/scan/f5bade54-1352-40e5-81ed-e7f4d8b87791
  SHA-256: 186c8220aa73af73c32e7934aa71ea6e8981db8ed4ea0eaa1d8faa3680795fdf
- URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09ac8-2185-75df-b44a-6cf456133199.png
  Captured: 2026-09-13 12:40:10 UTC
  Source report: https://urlscan.io/result/01a09ac8-2185-75df-b44a-6cf456133199/
  SHA-256: f9817f6e98de0d81cf2fa14e6cfcbcfb4e2d3aa053604bf1006525d2be7b12b4
- URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09adb-047a-76db-bd31-e84330892441.png
  Captured: 2026-09-13 13:00:45 UTC
  Source report: https://urlscan.io/result/01a09adb-047a-76db-bd31-e84330892441/
  SHA-256: bcc3c0ed423469e88345b1f8633b28d75cb6a626573db85db5848a9adefb42ee
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09d6e-8fd3-740c-85de-63ae96ea8da2.png
  Captured: 2026-09-14 01:01:12 UTC
  Source report: https://urlscan.io/result/01a09d6e-8fd3-740c-85de-63ae96ea8da2/
  SHA-256: 790c474cb114ab83819d8855b3c87a4b13a955114c56103d5058558a1fdcdba8
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0c0e6-6685-702e-a303-9223b9c9565d.png
  Captured: 2026-09-20 22:18:52 UTC
  Source report: https://urlscan.io/result/01a0c0e6-6685-702e-a303-9223b9c9565d/
  SHA-256: 790c474cb114ab83819d8855b3c87a4b13a955114c56103d5058558a1fdcdba8
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c146-89e8-7129-9cb0-0ef4c35ad5f3.png
  Captured: 2026-09-21 00:03:49 UTC
  Source report: https://urlscan.io/result/01a0c146-89e8-7129-9cb0-0ef4c35ad5f3/
  SHA-256: 790c474cb114ab83819d8855b3c87a4b13a955114c56103d5058558a1fdcdba8
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a139aa-86fa-72ad-b8df-bd6153f84bf5.png
  Captured: 2026-10-14 09:07:33 UTC
  Source report: https://urlscan.io/result/01a139aa-86fa-72ad-b8df-bd6153f84bf5/
  SHA-256: 557a6b74122605b814b72e7b9e068cade4a3ed6b5e55bf303697787b4ffca0f2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:43:53Z",
        "uuid": "01a0b01d-2faa-73c8-aebd-d409050aceee",
        "scanned_at": "2026-09-17T16:05:06Z",
        "final_url": "https://90claim-free-robux-instant.blogspot.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://90claim-free-robux-instant.blogspot.com/",
                "from": "http://90claim-free-robux-instant.blogspot.com/",
                "status": 307
            }
        ],
        "ip": "2a00:1450:4001:c13::84",
        "domains": [
            "d3r33tlb373kwk.cloudfront.net",
            "d39fkvblvwpxa1.cloudfront.net",
            "fonts.gstatic.com",
            "s4.histats.com",
            "s10.histats.com",
            "wallpaperaccess.com",
            "static.cloudflareinsights.com",
            "d1chbu4sfo2xhu.cloudfront.net",
            "encrypted-tbn0.gstatic.com",
            "fonts.googleapis.com",
            "static.cloudflareitems.com"
        ],
        "ips": [
            "142.251.110.132",
            "192.99.201.97",
            "2606:4700:10::6814:883",
            "2600:9000:2096:ba00:1b:ebf3:e500:21",
            "142.250.154.94",
            "172.66.163.237",
            "2606:4700::6810:5049",
            "2600:9000:275d:200:3:4462:8480:21",
            "2600:9000:213f:6400:1d:8620:2e40:21",
            "2a00:1450:4001:c17::8a",
            "2a00:1450:4001:c0f::5f",
            "2a00:1450:4001:c13::84"
        ],
        "asns": [
            "15169",
            "16276",
            "13335",
            "16509"
        ],
        "countries": [
            "US",
            "CA",
            "DE"
        ],
        "link_domains": [
            "www.blogger.com"
        ],
        "doc_hash": "8f0f46984b23cb0e5505e74c38607cb97456a9dc6956bbf2633c4092d1d8533f",
        "script_hashes": [
            "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568"
        ],
        "globals": [
            "adsbygoogle",
            "WaLjy_mYT_icjzBc",
            "xfContentLocker",
            "__cfRLUnblockHandlers",
            "CPBContentLocker",
            "xfLock",
            "xfGetFeedURL",
            "xfGetIframeURL",
            "xfGetIframeHTML",
            "xfUnlock",
            "xfOfferComplete",
            "xfOffersComplete",
            "xfCheckForLead",
            "xfComplete",
            "CPABuildLock",
            "CPABuildGetFeedURL",
            "CPABuildGetIframeURL",
            "CPABuildGetIframeHTML",
            "CPABuildUnlock",
            "CPABuildOfferComplete",
            "CPABuildOffersComplete",
            "CPABuildCheckForLead",
            "CPABuildComplete",
            "_RH",
            "_Vm",
            "_uj",
            "_Ew",
            "_HW",
            "_oy",
            "_Jf",
            "_Mz",
            "_EQ",
            "_ZU",
            "_lL",
            "_yk",
            "_Tm",
            "_Ht",
            "_nS",
            "_Xy",
            "_qr"
        ],
        "cookies": [
            "HstCfa5007660",
            "HstCla5007660",
            "HstCmu5007660",
            "HstPn5007660",
            "HstPt5007660",
            "HstCnv5007660",
            "HstCns5007660"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-27T08:05:56Z",
            "valid_from": "2026-09-04T08:05:57Z"
        },
        "domain_age_days": 18,
        "apex_age_days": 18,
        "tls_age_days": 13,
        "tls_valid_days": 83,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:32:09Z",
        "uuid": "f5bade54-1352-40e5-81ed-e7f4d8b87791",
        "scanned_at": "2026-09-20T01:00:14Z",
        "final_url": "https://90claim-free-robux-instant.blogspot.com/",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://90claim-free-robux-instant.blogspot.com/",
                "status": 307
            },
            {
                "url": "https://90claim-free-robux-instant.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "5fb2992aafb48e971c8aa7f599aa4c943edb1810311e81a87e2206c877b629d2",
        "doc_hash": "8f0f46984b23cb0e5505e74c38607cb97456a9dc6956bbf2633c4092d1d8533f",
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "90claim-free-robux-instant.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "90claim-free-robux-instant.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.250.129.132",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T03:23:07Z",
        "analysis_at": "2026-10-14T03:36:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 7,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "ESET": "phishing",
            "G-Data": "phishing",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "phishing",
            "Yandex Safebrowsing": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2000-07-31T21:38:58Z",
        "expires": "2027-07-31T21:38:58Z",
        "updated": "2026-06-29T10:34:06Z",
        "first_seen": "2026-09-02T09:40:31Z",
        "dns": [
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2607:f8b0:4001:c56::84"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "142.250.152.132"
            }
        ],
        "dns_at": "2026-10-14T03:41:24Z",
        "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c",
        "cert": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "issuer": "Google Trust Services / WR2",
            "serial": "314459051a6865d30a64aaa66545849a",
            "sha256": "4857922e4732af9da27dfbbe57b2c741da8a8af83def47e9345092cbed8e2508",
            "subject": "misc-sni.blogspot.com",
            "valid_to": "2026-12-11T20:01:21Z",
            "valid_from": "2026-09-18T20:01:22Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2000-07-31T07:00:00Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited",
                "serverDeleteProhibited",
                "serverTransferProhibited",
                "serverUpdateProhibited"
            ],
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```