# PhishDestroy domain threat record: hungakiraroblox.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hungakiraroblox.com/
Machine-readable companion: https://phishdestroy.io/domain/hungakiraroblox.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-04 04:01:01 UTC
- Last availability or vendor check: 2026-10-22 10:40:19 UTC
- Stored record updated: 2026-10-22 15:45:57 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Roblox

## Stored infrastructure

- Observed IP address: 103.98.153.44
- Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, hungakiraroblox.com): 2022-11-15 13:55:27 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a10513-c688-74ec-8acb-837a7a337c78/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hungakiraroblox.com
- Certificate Transparency search: https://crt.sh/?q=%25.hungakiraroblox.com
- Web Archive lookup: https://web.archive.org/web/*/https://hungakiraroblox.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
hungakiraroblox.com is a Vietnamese-language Roblox storefront that PhishDestroy classifies as a gaming scam. Its page title, "Hungakiraroblox.vn - Vòng Quay, Mua Bán Robux - Mua Bán Acc Roblox", advertises a prize wheel, Robux trading and Roblox account sales, which points squarely at young players in Vietnam. We first flagged it on 2026-10-04, and it was still online and serving content on 2026-10-19.

How the scam works
Sites like this sell spins on a "vòng quay" (lucky wheel) and promise cheap Robux or rare Roblox accounts. Players pay by bank transfer or prepaid top-up cards to fund an on-site balance, then spend it on spins or purchases that rarely pay out. Promised Robux or accounts never arrive, or the delivered account is later reclaimed. Some variants also ask for the player's own Roblox login to "deliver" Robux, which hands the account to the operator. Victims lose the money they topped up and sometimes their Roblox account.

Evidence
On 2026-10-07, 7 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue, MalwareURL and SOCRadar. That is a minority of engines, but the flagging vendors are independent of one another. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have been tracking it as well. Among the blocklists we checked, only PhishDestroy lists it so far.

Infrastructure
The domain was registered on 2022-11-15 through GMO Internet Group (Onamae.com), almost four years before we detected it. That suggests a long-running operation rather than a throwaway site. It is hosted in Vietnam on HQG Technology Solutions' network (HQG-AS-VN), which matches its Vietnamese audience. Its Let's Encrypt certificate gives it a browser padlock, but the padlock only means the connection is encrypted. It says nothing about whether the shop is honest.

What to do
Do not top up a balance, buy spins, or pay for Robux or accounts on this site. If you already paid, contact your bank or card provider right away and keep transfer receipts and screenshots. If you typed your Roblox username and password here, change the password immediately, turn on two-step verification, and check your account for unfamiliar sessions or missing items. Parents should talk with children about "cheap Robux" and lucky-wheel sites, because Robux are only sold through Roblox itself. Security teams can block the domain and its hosting IP, and can report it to Roblox and the hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a10513-c688-74ec-8acb-837a7a337c78/
VirusTotal report: https://www.virustotal.com/gui/domain/hungakiraroblox.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hungakiraroblox.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:44:57 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/SDkKk6Lw/154ee3194f35.png
  Captured: 2026-10-04 04:03:26 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a10513-c688-74ec-8acb-837a7a337c78.png
  Captured: 2026-10-04 04:03:26 UTC
  Source report: https://urlscan.io/result/01a10513-c688-74ec-8acb-837a7a337c78/
- URLScan capture 2: https://urlscan.io/screenshots/01a10016-e90f-73bc-9069-dac6d15110bd.png
  Captured: 2026-10-04 04:01:01 UTC
  Source report: https://urlscan.io/result/01a10513-c688-74ec-8acb-837a7a337c78/
- URLQuery: https://screenshots.phishdestroy.io/uq/cf592e44-948c-4604-9cb4-d557248c6543.png
  Source report: https://urlquery.net/report/cf592e44-948c-4604-9cb4-d557248c6543
  SHA-256: 031c61267411decbb0ee1a2250ae5b075d03137efc6151839e453b6c77d4ec3e
- URLScan · 2026-08-13: https://screenshots.phishdestroy.io/us/019ffa69-9077-7267-8ad7-642ee08873c9.png
  Captured: 2026-08-13 09:17:41 UTC
  Source report: https://urlscan.io/result/019ffa69-9077-7267-8ad7-642ee08873c9/
  SHA-256: b89a6fef27e0f8eefb0eb5cbba3a5f7f163397d6f409c08f374d8c52af7355b3
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aa89-a23d-755b-b0b9-95ab1f02858e.png
  Captured: 2026-09-16 14:05:55 UTC
  Source report: https://urlscan.io/result/01a0aa89-a23d-755b-b0b9-95ab1f02858e/
  SHA-256: b1bea106dcf1eb418a43b0132ac6b870200e12a74bec13f45227ae2752314140
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bf41-68a5-7137-9fc5-3882eca7812f.png
  Captured: 2026-09-20 14:39:00 UTC
  Source report: https://urlscan.io/result/01a0bf41-68a5-7137-9fc5-3882eca7812f/
  SHA-256: 0301b72bd3d034bf7e8b2f1b10bf1904157f394b07c38909e926a0ec737671db
- URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a10016-e90f-73bc-9069-dac6d15110bd.png
  Captured: 2026-10-03 04:48:23 UTC
  Source report: https://urlscan.io/result/01a10016-e90f-73bc-9069-dac6d15110bd/
  SHA-256: c0884555cef3439aa8623b215154483c0061fe0c532180b16583bd9ff93dc7dd
- URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10516-be70-7411-9807-669f9be59c5e.png
  Captured: 2026-10-04 04:05:46 UTC
  Source report: https://urlscan.io/result/01a10516-be70-7411-9807-669f9be59c5e/
  SHA-256: cd7de4c87b3e210635cfd856b77aeef05fe43bb5001408f645db97447e36d9ab

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:33:27Z",
        "uuid": "01a10513-c688-74ec-8acb-837a7a337c78",
        "scanned_at": "2026-10-04T04:02:34Z",
        "final_url": "https://hungakiraroblox.com/dich-vu/meme-sea-anime",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hungakiraroblox.com/dich-vu/meme-sea-anime",
                "from": "http://hungakiraroblox.com/dich-vu/meme-sea-anime",
                "status": 307
            }
        ],
        "ip": "103.98.153.44",
        "domains": [
            "upanh.top",
            "static.xx.fbcdn.net",
            "www.facebook.com",
            "connect.facebook.net",
            "unpkg.com",
            "cdnjs.cloudflare.com",
            "sachinchoolur.github.io",
            "www.google.co.uk",
            "stats.g.doubleclick.net",
            "region1.analytics.google.com",
            "www.googletagmanager.com",
            "cdn.jsdelivr.net",
            "lookaside.fbsbx.com"
        ],
        "ips": [
            "57.144.248.1",
            "142.251.13.94",
            "142.251.127.156",
            "216.239.32.36",
            "57.144.244.128",
            "142.250.154.97",
            "104.17.207.5",
            "185.199.111.153",
            "172.67.221.29",
            "104.17.24.14",
            "104.18.0.22",
            "103.98.153.44"
        ],
        "asns": [
            "32934",
            "15169",
            "13335",
            "54113",
            "131374"
        ],
        "countries": [
            "DE",
            "US",
            "VN"
        ],
        "link_domains": [
            "discord.gg",
            "www.facebook.com",
            "m.me"
        ],
        "social": [
            "https://discord.gg/5V3s44FFsd",
            "https://www.facebook.com/hungakiraroblox.vn"
        ],
        "doc_hash": "32b4a0c322abac8e537fad3cae6819c3c2a0aab5e34f5cbdacdb5504557c1844",
        "script_hashes": [
            "f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d",
            "114978ad77a2514fee97045f4c69c968b446f0574d5f5e853c648ff87bdb85a8",
            "a8827fb5315259b6e4de8e5929cdd50561dc8d4580e31aaf470c79c10bc98161",
            "bf9f3d23565ec9867a60f73c0f1d31167c3a9628196d5f85d1aec626e354caa4",
            "a86985e944ccbe60d056e96d01cb7d2c096d34f24aebf2fa58f3e5ac54458dab",
            "385074cb4eb92d7e25d7a22942d085a99b43d44961844e19fbe784dbe86bac3b",
            "141deadb78d3ae1a42c45c22cb5951b4c75db33be1c82a570a8c682c14431348",
            "3b116bcb84b5b6f7b2c1f791754ea45946a3ca634814bfd0d2e453e155898e2d",
            "953902c7bc7fb7722984fd293808d0a2a6df20af389db084f83f9722f3a61a77",
            "876bcc80f527903e5b775d1378988f09472df5c3e861579266894190af0c6662"
        ],
        "globals": [
            "triggerScriptLoader",
            "loadScripts",
            "fbq",
            "_fbq",
            "Accordion",
            "Collapse",
            "Carousel",
            "Dismiss",
            "Dropdown",
            "Modal",
            "Tabs",
            "Tooltip",
            "$",
            "jQuery",
            "setImmediate",
            "clearImmediate",
            "swal",
            "sweetAlert",
            "jQuery1124034069094651347165",
            "Swiper",
            "webpackJsonp",
            "googleUser",
            "startApp",
            "startAppMobile",
            "appAjax",
            "delay",
            "handleSignin",
            "handleRegister",
            "handleLogout",
            "handleBuyAccount",
            "handleRutRobux",
            "handleNhanRobuxThanhVienMoi",
            "handleAddGiftcodeAccount",
            "checkLogin",
            "FBLogin",
            "verify_user",
            "onSuccess",
            "onFailure",
            "attachSignin",
            "scrapeLink"
        ],
        "cookies": [
            "_ga_H724S1XJBP",
            "_ga",
            "_fbp",
            "XSRF-TOKEN",
            "laravel_session"
        ],
        "storage_keys": [
            "__test__1791086547689",
            "__test__1791086547688",
            "__test__1791086547690",
            "lastExternalReferrer",
            "lastExternalReferrerTime",
            "fbssls_471199501415887"
        ],
        "tls": {
            "san": [
                "hungakiraroblox.com",
                "www.hungakiraroblox.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "hungakiraroblox.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T17:31:56Z",
            "valid_from": "2026-08-31T17:31:57Z"
        },
        "domain_age_days": 1412,
        "apex_age_days": 1412,
        "tls_age_days": 33,
        "tls_valid_days": 89,
        "requests": 97,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 58,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T13:18:09Z",
        "analysis_at": "2026-10-16T13:44:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "popularity": {
            "Cloudflare Radar": 1000000
        },
        "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
        "created": "2022-11-15T13:55:27Z",
        "expires": "2027-11-15T13:55:27Z",
        "updated": "2025-08-21T12:43:58Z",
        "first_seen": "2024-03-02T23:41:53Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "103.98.153.44"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=QW6MZLFn4FbRzp4_6ONWYTqmFsnkd9mty7ONQ577GmY"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ruth.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "art.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "art.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-16T13:59:11Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "hungakiraroblox.com",
                "www.hungakiraroblox.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "66d5f0c7d5cfe27a9e85c5efce8b1218ff1",
            "sha256": "b0e0b3ff40244a7f1d720256b23cbe6e91d3f3b679a463833b8f6252c46cc929",
            "subject": "hungakiraroblox.com",
            "valid_to": "2026-11-29T17:31:56Z",
            "valid_from": "2026-08-31T17:31:57Z"
        },
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "registrar_iana_id": "49",
            "registrar_url": "https://internet.gmo/",
            "created": "2022-11-15T13:55:27Z",
            "updated": "2025-08-21T12:43:58Z",
            "expires": "2027-11-15T13:55:27Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "art.ns.cloudflare.com",
                "ruth.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-11-15T04:55:27Z",
                "last changed": "2025-08-21T12:49:41Z",
                "registration": "2022-11-15T04:55:27Z",
                "registrar expiration": "2027-11-15T04:55:27Z",
                "last update of RDAP database": "2026-10-16T13:59:11Z"
            }
        }
    }
}
```