# cashoutrobux.roblox-635.workers.dev — SUSPICIOUS

> Beware the Roblox crypto drainer at cashoutrobux.roblox-635.workers.dev - a phishing page impersonating Roblox to steal crypto.

## Summary
PhishDestroy identifies the domain cashoutrobux.roblox-635.workers.dev as a generic phishing host active as of the latest scan. This site masquerades as a Roblox-themed rewards portal, likely leveraging social engineering to trick users into connecting crypto wallets or entering credentials. The infrastructure aligns with known drainer kits that target gaming platforms and cryptocurrency users, though no signature kit has been isolated yet.  This domain resolves to IP 188.114.97.3 and was registered through Cloudflare, Inc. VirusTotal currently reports 0 detections out of 95 engines at the time of writing, while Google Safe Browsing categorizes it under SOCIAL_ENGINEERING. The SSL certificate is issued by Let’s Encrypt, and the domain is hosted on Cloudflare Workers. No creation date is publicly confirmed, but the low detection count and active status suggest recent deployment.  As of now, the threat remains under investigation with a status marked active and a risk level classified as under_investigation. PhishDestroy advises users to avoid interacting with the domain and to verify any suspicious links using its platform. Because the domain remains undetected by most scanners at this time, the risk of exposure remains elevated despite the low VT score. Users are encouraged to report encounters and monitor for related variants.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/cashoutrobux.roblox-635.workers.dev
- PhishDestroy: https://phishdestroy.io/domain/cashoutrobux.roblox-635.workers.dev/
- LLM endpoint: https://phishdestroy.io/domain/cashoutrobux.roblox-635.workers.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cashoutrobux.roblox-635.workers.dev/
Last updated: 2026-04-14