# PhishDestroy domain threat record: rblx-steal-egg.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rblx-steal-egg.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/rblx-steal-egg.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 04:19:48 UTC
- Last availability or vendor check: 2026-10-22 10:06:36 UTC
- Stored record updated: 2026-10-22 15:45:41 UTC
- VirusTotal detections in the stored snapshot: 3/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: roblox

## Stored infrastructure

- Observed IP address: 142.250.154.132
- Registrar in stored WHOIS data: Google Blogger
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09e28-78cb-74a8-8c5f-a87912bd2111/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rblx-steal-egg.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.rblx-steal-egg.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://rblx-steal-egg.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rblx-steal-egg.blogspot.com is a free Blogger page that borrows Roblox's identity through the "rblx" shorthand and presents itself as "Steal An EGG - Drops". It targets Roblox players, many of them young, who are hunting for free in-game items. PhishDestroy first flagged it on 2026-09-14. As of 2026-10-19 the address still resolves, but its main page currently shows no content.

How the scam works
Pages like this promise drops, giveaways or rare items tied to a popular Roblox game. The page title "Steal An EGG - Drops" fits that pattern. The visitor is then asked to sign in, verify their account, or paste in account details or browser data to claim the reward. Whatever is handed over lets the operator take control of the account and empty its inventory, Robux and limited items. Victims also often lose access to the account itself.

Evidence
VirusTotal results from 2026-09-22 show 3 of 89 engines marking the page as malicious: alphaMountain.ai, Forcepoint ThreatSeeker and VIPRE. That is a thin margin, so most security tools would still let a player open the page without any warning. PhishDestroy is currently the only blocklist listing it. With coverage this low, the domain name and the drop-themed lure are the clearest warning signs.

Infrastructure
The page sits on a Blogger subdomain, so the operator never had to register or pay for a domain. Setting up a page like this takes minutes and costs nothing to abandon. It is served from Google LLC's network in the US with a Google Trust Services certificate, like every Blogger site. The padlock in the browser therefore says nothing about who runs the page. The empty main page suggests the lure may be swapped in, moved or removed at short notice.

What to do
If you entered your Roblox username and password here, change the password at once and turn on two-step verification. Then use the option to log out of all other sessions. If you pasted any code or browser data the page asked for, treat the account as compromised and do the same. Check your inventory, trade history and Robux balance, and contact Roblox support about anything missing. Parents should remind children that real Roblox items are never handed out through outside blog pages. Defenders and school or family network admins should block the subdomain and report it to Blogger as Roblox impersonation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09e28-78cb-74a8-8c5f-a87912bd2111/
VirusTotal report: https://www.virustotal.com/gui/domain/rblx-steal-egg.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rblx-steal-egg.blogspot.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:03 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09e28-78cb-74a8-8c5f-a87912bd2111.png
  Captured: 2026-09-14 04:19:48 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a09e28-78cb-74a8-8c5f-a87912bd2111.png
  Captured: 2026-09-22 03:32:35 UTC
  Source report: https://urlscan.io/result/01a09e28-78cb-74a8-8c5f-a87912bd2111/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/07d846e3-d5fe-4937-ad78-5c7375739bc6.png
  Captured: 2026-09-21 07:56:26 UTC
  Source report: https://radar.cloudflare.com/scan/07d846e3-d5fe-4937-ad78-5c7375739bc6
  SHA-256: 43a81f963901221eaa09574b5041869cd2f3b01b9fab1b2c110f37a4e2d2d983

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:22:49Z",
        "uuid": "01a09e28-78cb-74a8-8c5f-a87912bd2111",
        "scanned_at": "2026-09-14T04:24:15Z",
        "final_url": "https://rblx-steal-egg.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://rblx-steal-egg.blogspot.com/",
                "from": "https://rblx-steal-egg.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "2a00:1450:4001:c21::84",
        "domains": [
            "i.imgur.com",
            "i.postimg.cc",
            "d3r33tlb373kwk.cloudfront.net",
            "s4.histats.com",
            "s10.histats.com",
            "fonts.gstatic.com",
            "d19k1sh57v5k0g.cloudfront.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.127.132",
            "192.99.148.55",
            "2606:4700:10::6814:883",
            "2600:9000:2096:5c00:1b:ebf3:e500:21",
            "142.250.154.94",
            "2600:9000:213f:8c00:c:259f:e400:21",
            "195.154.239.27",
            "199.232.196.193",
            "2a00:1450:4001:c0f::5f",
            "2a00:1450:4001:c21::84"
        ],
        "asns": [
            "15169",
            "16276",
            "13335",
            "16509",
            "12876",
            "54113"
        ],
        "countries": [
            "US",
            "CA",
            "FR",
            "DE"
        ],
        "doc_hash": "da6f954cadbbe15ae1e70b307ce5cfae7034d1ad162c170df1fee9093c7df232",
        "globals": [
            "toggleTheme",
            "openModal",
            "closeModal",
            "startVerification",
            "proceedToOffer",
            "resetSteps",
            "setStepActive",
            "setStepCompleted",
            "changeLanguage",
            "switchTab",
            "vBHIc_Nlu_ZVdcRc",
            "xfContentLocker",
            "__cfRLUnblockHandlers",
            "CPBContentLocker",
            "xfLock",
            "xfGetFeedURL",
            "xfGetIframeURL",
            "xfGetIframeHTML",
            "xfUnlock",
            "xfOfferComplete",
            "xfOffersComplete",
            "xfCheckForLead",
            "xfComplete",
            "CPABuildLock",
            "CPABuildGetFeedURL",
            "CPABuildGetIframeURL",
            "CPABuildGetIframeHTML",
            "CPABuildUnlock",
            "CPABuildOfferComplete",
            "CPABuildOffersComplete",
            "CPABuildCheckForLead",
            "CPABuildComplete",
            "_RH",
            "_Vm",
            "_uj",
            "_Ew",
            "_HW",
            "_oy",
            "_Jf",
            "_Mz"
        ],
        "cookies": [
            "HstCfa4992944",
            "HstCla4992944",
            "HstCmu4992944",
            "HstPn4992944",
            "HstPt4992944",
            "HstCnv4992944",
            "HstCns4992944"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:52Z",
            "valid_from": "2026-08-10T08:38:53Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 34,
        "tls_valid_days": 83,
        "requests": 40,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:57Z",
        "uuid": "07d846e3-d5fe-4937-ad78-5c7375739bc6",
        "scanned_at": "2026-09-21T07:56:26Z",
        "final_url": "https://rblx-steal-egg.blogspot.com/",
        "status": 404,
        "history": [
            {
                "url": "https://rblx-steal-egg.blogspot.com/",
                "status": 404
            }
        ],
        "dom_hash": "c7ac6bf954f4bdddc3973031e94ef3fa1fbe56e830a188485b72ecebc049f7a9",
        "doc_hash": "6531840c705e4326f7c6488ac42bb3f9f5c31eee3773d5ff2c7567c535b9015d",
        "domain_risks": [
            "Gaming",
            "Entertainment"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rblx-steal-egg.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "rblx-steal-egg.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.250.180.1",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:54:02Z",
        "analysis_at": "2026-09-21T10:05:35Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 3,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "VIPRE": "malware",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Personal Sites/Blogs, Phishing (alphaMountain.ai)"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2000-07-31T21:38:58Z",
        "expires": "2027-07-31T21:38:58Z",
        "updated": "2026-06-29T10:34:06Z",
        "first_seen": "2026-09-14T04:19:38Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2607:f8b0:4001:c0f::84"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "173.194.193.132"
            },
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dns_at": "2026-09-21T10:12:40Z",
        "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c",
        "cert": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "issuer": "Google Trust Services / WR2",
            "serial": "10aa2bf354aa9c480a0e93b4b181c5a1",
            "sha256": "5dcd6230b982f90af44da1780050369d3d8d12b4686c67a503c1eae4e5b9fb2c",
            "subject": "misc-sni.blogspot.com",
            "valid_to": "2026-11-27T08:05:48Z",
            "valid_from": "2026-09-04T08:05:49Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2000-07-31T07:00:00Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited",
                "serverDeleteProhibited",
                "serverTransferProhibited",
                "serverUpdateProhibited"
            ],
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```