# PhishDestroy domain threat record: frtnii.blogspot.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/frtnii.blogspot.com/ Machine-readable companion: https://phishdestroy.io/domain/frtnii.blogspot.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-11 04:58:47 UTC - Last availability or vendor check: 2026-10-22 10:07:06 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 14/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Roblox ## Stored infrastructure - Observed IP address: 142.251.13.132 - Registrar in stored WHOIS data: Google Blogger - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/frtnii.blogspot.com - Certificate Transparency search: https://crt.sh/?q=%25.frtnii.blogspot.com - Web Archive lookup: https://web.archive.org/web/*/https://frtnii.blogspot.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview frtnii.blogspot.com is a Blogger page titled "Roblox Robux Generator" that lures Roblox players, many of them children and teenagers, with the promise of free in-game currency. PhishDestroy classifies it as a gaming scam and first saw it on 2026-09-11. As of 2026-10-19 the page was still online and serving its content. How the scam works No tool can create Robux. The currency exists only on Roblox's own servers, so any "generator" is a lure. Pages like this usually ask for a Roblox username, sometimes the password too, and then stall the visitor behind a fake "human verification" step. That step pushes surveys, app installs or sign-ups that earn the operator money. Players who type in their login details risk losing the account itself, along with any purchased items and Robux already on it. Evidence On 2026-09-20, 14 of 89 VirusTotal engines flagged the page as malicious. The vendors that flagged it include alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft, Fortinet and G-Data. Several of these feed browser and endpoint protection, so many users may get a warning, but most engines still pass the page as clean. Among the blocklists we track, only PhishDestroy currently lists it. Infrastructure The scam sits on a free blogspot.com subdomain, so the operator never registered a domain and paid nothing to launch it. That also means there is no registration date to measure against our first sighting. Google Blogger serves the page from Google LLC infrastructure in the US. Its Google Trust Services certificate is the one every Blogger site gets automatically, so the padlock in the browser says nothing about whether the page is safe. What to do If you entered your Roblox password here, change it right away on the official Roblox site, turn on 2-Step Verification, and sign out of all other sessions. Check that your inventory and Robux balance are intact. Change the password anywhere else you reused it, and uninstall any app the "verification" step pushed you to download. Parents should explain to children that free Robux offers are always scams. Defenders can block the subdomain, report it to Blogger as a policy violation, and flag it to Roblox's trust and safety team. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/frtnii.blogspot.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=frtnii.blogspot.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:29 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f65638d8-4605-4699-b88e-db184548b810.png Captured: 2026-09-18 17:51:25 UTC Source report: https://radar.cloudflare.com/scan/f65638d8-4605-4699-b88e-db184548b810 SHA-256: 36224ce7c438a3a53e91b08822e172f7f6d1fe4c59f4e8fc5362c9d9b52832f2 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:34:32Z", "uuid": "f65638d8-4605-4699-b88e-db184548b810", "scanned_at": "2026-09-18T17:51:25Z", "final_url": "https://frtnii.blogspot.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://frtnii.blogspot.com/", "status": 307 }, { "url": "https://frtnii.blogspot.com/", "status": 200 } ], "dom_hash": "ae2ef6deafa232704cb4fa437ccc286cd0a4eaa989e8476d90b135b266d0b3cc", "doc_hash": "74fdaab4f3543065fbbd0e0ae299e9f3c9fbd8e100952f2a9ed7d8ae258204a2", "domain_risks": [ "Gaming", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "frtnii.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "name": "frtnii.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dnssec_valid": false, "ip": "216.58.198.33", "whois": { "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T21:38:58Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T06:17:08Z", "analysis_at": "2026-10-21T00:02:10Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 14, "suspicious": 1, "undetected": 32 }, "detections": { "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "BitDefender": "misc", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "expires": "2027-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "first_seen": "2024-12-22T14:28:31Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2607:f8b0:4001:c64::84" }, { "ttl": 300, "type": "A", "value": "142.251.183.132" }, { "ttl": 300, "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dns_at": "2026-10-21T00:02:21Z", "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c", "cert": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "issuer": "Google Trust Services / WE2", "serial": "814ac5b024f8ff6f10caaecf9f796a9f", "sha256": "7e702db2cd863f12878210369da95cee319bdb748393501d05c91b69cf032638", "subject": "misc-sni.blogspot.com", "valid_to": "2026-12-21T18:40:33Z", "valid_from": "2026-09-28T18:40:34Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2000-07-31T07:00:00Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "serverDeleteProhibited", "serverTransferProhibited", "serverUpdateProhibited" ], "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ], "dnssec": "unsigned" } } } ```