# PhishDestroy domain threat record: jdbdkdbsosu.blogspot.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/jdbdkdbsosu.blogspot.com/ Machine-readable companion: https://phishdestroy.io/domain/jdbdkdbsosu.blogspot.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-16 11:31:10 UTC - Last availability or vendor check: 2026-10-22 10:07:17 UTC - Stored record updated: 2026-10-22 15:45:43 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 142.251.127.132 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 404 - Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/jdbdkdbsosu.blogspot.com - Certificate Transparency search: https://crt.sh/?q=%25.jdbdkdbsosu.blogspot.com - Web Archive lookup: https://web.archive.org/web/*/https://jdbdkdbsosu.blogspot.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview jdbdkdbsosu.blogspot.com is a Blogspot page titled "GET FREE ROBUX" that PhishDestroy classifies as a gaming scam. It baits Roblox players, a largely young audience, with the promise of free in-game currency. PhishDestroy first flagged it on 2026-09-16. As of 2026-10-19 the site still responds, but its main page currently shows no content. How the scam works Free Robux pages follow a familiar script. Only Roblox itself issues Robux, so any page offering them for free is lying. The visitor is asked for a Roblox username, sometimes a password, and is then sent through a "human verification" step of surveys, app installs or offer sign-ups that never ends in a reward. The real payout goes to the operator: hijacked game accounts and their inventories, harvested personal details, affiliate commissions from the offers, and sometimes unwanted software on the victim's device. Evidence Six of 89 engines on VirusTotal flagged the page when it was checked on 2026-09-23: alphaMountain.ai, BitDefender, ESET, G-Data, Gridinsoft and Sophos. That count is modest, but it comes from several unrelated security vendors and matches PhishDestroy's own listing. PhishDestroy is currently the only blocklist that includes the domain. Infrastructure The page runs on a throwaway Blogspot subdomain with a random-looking keyboard-mash name. That setup costs nothing to create and is easy to abandon. It is served from Google LLC infrastructure in the US with a Google Trust Services certificate, which Blogspot issues automatically to every blog, so the padlock says nothing about whether the page is trustworthy. What to do If you typed your Roblox password on this page, change it at once and turn on 2-Step Verification. Then check your account for unfamiliar logins, trades or spending, and reset the password anywhere else you reuse it. If you installed an app or extension as part of a "verification" step, uninstall it and run a malware scan. Parents should explain that no site can give out free Robux. Defenders can block the hostname and report the blog to Google through Blogger's abuse channel. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/jdbdkdbsosu.blogspot.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=jdbdkdbsosu.blogspot.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:25 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b1fe6027-1f38-433d-88ea-a7553027d349.png Captured: 2026-09-23 03:39:07 UTC Source report: https://radar.cloudflare.com/scan/b1fe6027-1f38-433d-88ea-a7553027d349 SHA-256: 93e2c5d14efe6dc05a0b052615e4957df063b2e94bc97aec62e5f50a4a300435 - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a9ff-9098-747e-bf18-26305503267a.png Captured: 2026-09-16 11:35:00 UTC Source report: https://urlscan.io/result/01a0a9ff-9098-747e-bf18-26305503267a/ SHA-256: cd2c29cf916eade4bf70ebac0c36fd811d2a3e707a06be1b4686c326294490cf - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b2d3-c2f9-7353-b976-df74e3c7bc80.png Captured: 2026-09-18 04:43:45 UTC Source report: https://urlscan.io/result/01a0b2d3-c2f9-7353-b976-df74e3c7bc80/ SHA-256: d6f4c975593701fe6db266563fe39b583107bc0d038090a1b462ce7e88549836 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd8f-c53c-758e-98bd-e941df528f12.png Captured: 2026-09-23 09:19:13 UTC Source report: https://urlscan.io/result/01a0cd8f-c53c-758e-98bd-e941df528f12/ SHA-256: 26846ea810d946c1ac1a00a1445314838e743d08717b199bb3ec2bb51354d927 - URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a1046d-2dd8-72aa-9fbc-f50365019432.png Captured: 2026-10-04 01:00:33 UTC Source report: https://urlscan.io/result/01a1046d-2dd8-72aa-9fbc-f50365019432/ SHA-256: f8173109661aec870b6a08b91188f91ed5fbae2e0ae01758d41dc6cf4a7b520e - URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a1053d-0779-7610-835d-e0316aaf27ad.png Captured: 2026-10-04 04:47:36 UTC Source report: https://urlscan.io/result/01a1053d-0779-7610-835d-e0316aaf27ad/ SHA-256: 7127a8397ad0655640861f2ead0ca162e0d6a3d7553ed52436cd8678ba57a98d - URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a13089-4f92-72ff-baa8-d6a78b07ade2.png Captured: 2026-10-12 14:34:34 UTC Source report: https://urlscan.io/result/01a13089-4f92-72ff-baa8-d6a78b07ade2/ SHA-256: 5980a16d29b8a175c3acb14cf9c0880ef667c5dc194477feb69936c2d3d14b44 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:58Z", "uuid": "b1fe6027-1f38-433d-88ea-a7553027d349", "scanned_at": "2026-09-23T03:39:07Z", "final_url": "https://jdbdkdbsosu.blogspot.com/", "status": 200, "history": [ { "url": "https://jdbdkdbsosu.blogspot.com/", "status": 200 } ], "dom_hash": "4a758d1fdd551f05cbeed76f9f1383356fb8aee266c658de865c1ba4f0f3b919", "doc_hash": "0ae1735326fef4389efbb701462e52a935804f5270613798e6c6f696fc670c93", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "jdbdkdbsosu.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "name": "jdbdkdbsosu.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dnssec_valid": false, "ip": "142.251.33.193", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T21:38:58Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:29:01Z", "analysis_at": "2026-10-17T03:38:47Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 16, "suspicious": 0, "undetected": 30 }, "detections": { "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "malicious", "Kaspersky": "phishing", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "expires": "2027-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "first_seen": "2026-09-16T11:31:04Z", "dns": [ { "ttl": 300, "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "ttl": 300, "type": "AAAA", "value": "2607:f8b0:4001:c56::84" }, { "ttl": 300, "type": "A", "value": "142.250.152.132" } ], "dns_at": "2026-10-17T03:55:04Z", "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c", "cert": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "issuer": "Google Trust Services / WE2", "serial": "9d5a60aa1a77b2e30ad083111463b97f", "sha256": "96af029a35a29461434960b48ba2154af0c39c2d7eb0c4b553a22552f01a76ff", "subject": "misc-sni.blogspot.com", "valid_to": "2026-12-11T20:01:30Z", "valid_from": "2026-09-18T20:01:31Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2000-07-31T07:00:00Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "serverDeleteProhibited", "serverTransferProhibited", "serverUpdateProhibited" ], "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ], "dnssec": "unsigned" } } } ```