# PhishDestroy domain threat record: rboxe.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/rboxe.com/ Machine-readable companion: https://phishdestroy.io/domain/rboxe.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 01:44:18 UTC - Last availability or vendor check: 2026-10-22 10:18:36 UTC - Stored record updated: 2026-10-22 15:46:59 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: roblox ## Stored infrastructure - Observed IP address: 92.113.16.175 - Registrar in stored WHOIS data: HOSTINGER operations, UAB - Registration date (registry RDAP, rboxe.com): 2026-07-03 19:01:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a15c22-6b6d-72ec-8f5b-f771462c914d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rboxe.com - Certificate Transparency search: https://crt.sh/?q=%25.rboxe.com - Web Archive lookup: https://web.archive.org/web/*/https://rboxe.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has placed rboxe.com on its internal blocklist as a suspicious domain. The domain was first observed by PhishDestroy on 2026-10-21, when a page titled “Buy Robux” returned HTTP 200. How the scam works The detections from urlscan.io and Cloudflare Radar label the site as phishing, a category that typically attempts to collect user credentials or payment information by mimicking a trusted brand. No specific technique was captured on the page snapshot, so the exact method remains unknown. Evidence VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. urlscan.io captured the site on 2026-10-21 and its machine‑learning engine returned a malicious phishing verdict with a score of 78, identifying Roblox as the targeted brand. Cloudflare Radar also recorded a malicious phishing verdict on 2026-10-21. OTX listed one pulse referencing rboxe.com, and PhishDestroy’s internal blocklist marks the domain as present. Infrastructure The domain was registered with HOSTINGER operations, UAB on 2026-07-03. DNS resolution at the time of capture pointed to IP 92.113.16.175, which belongs to Hostinger International Limited and is listed in Germany. What to do Visitors should not enter Roblox credentials, payment details, or personal information on rboxe.com; if they have already done so, they should change their Roblox password and review account activity. Organizations can block the exact domain at the network perimeter and monitor logs for connections to the recorded IP. No wallet‑related remediation is required. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15c22-6b6d-72ec-8f5b-f771462c914d/ VirusTotal report: https://www.virustotal.com/gui/domain/rboxe.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rboxe.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 02:22:01 UTC ## Stored page captures - Primary capture: https://i.ibb.co/RGcJ3cqv/db093c7873e7.png Captured: 2026-10-21 01:46:16 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a15c22-6b6d-72ec-8f5b-f771462c914d.png Captured: 2026-10-21 01:46:16 UTC Source report: https://urlscan.io/result/01a15c22-6b6d-72ec-8f5b-f771462c914d/ - URLScan capture 2: https://urlscan.io/screenshots/01a12193-00b9-77fe-ba5a-b851ff292f00.png Captured: 2026-10-21 01:44:18 UTC Source report: https://urlscan.io/result/01a15c22-6b6d-72ec-8f5b-f771462c914d/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a1991ffb-62aa-4279-8988-93fd5542cf85.png Captured: 2026-10-21 01:46:03 UTC Source report: https://radar.cloudflare.com/scan/a1991ffb-62aa-4279-8988-93fd5542cf85 SHA-256: 29dc57af1db68dd357b89ed896f59e99b01178b22de3f0fc1197e4ea8c01def6 - URLQuery: https://screenshots.phishdestroy.io/uq/1dd21ac1-ed51-481d-8521-e93ff5178bc3.png Source report: https://urlquery.net/report/1dd21ac1-ed51-481d-8521-e93ff5178bc3 SHA-256: 47c94c16022bf31dda221330ce347f216b9309876097e23ddb82b1747f099e69 - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a12193-00b9-77fe-ba5a-b851ff292f00.png Captured: 2026-10-09 16:50:55 UTC Source report: https://urlscan.io/result/01a12193-00b9-77fe-ba5a-b851ff292f00/ SHA-256: 4843398e0e198f4d21c3aecb90b40ce8cf504f04ac0b67a976b10f832ae0ca79 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c25-d7eb-7553-9cd2-0fd978f270d0.png Captured: 2026-10-21 01:49:13 UTC Source report: https://urlscan.io/result/01a15c25-d7eb-7553-9cd2-0fd978f270d0/ SHA-256: 0feb4aeb82c0c3f9487e41bde1c111be7cc4ac02f6e97b3d7a3376ebc770483c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T01:46:58Z", "uuid": "01a15c22-6b6d-72ec-8f5b-f771462c914d", "scanned_at": "2026-10-21T01:45:30Z", "final_url": "https://rboxe.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rboxe.com/", "from": "http://rboxe.com/", "status": 307 } ], "ip": "91.108.99.52", "domains": [ "dtvpp42hfuyb2.cloudfront.net", "www.google-analytics.com", "pl31615488.profitableratecpmnetwork.com", "d1mikxzr3lp4va.cloudfront.net", "unpkg.com", "pl31632616.profitableratecpmnetwork.com", "www.googletagmanager.com" ], "ips": [ "18.67.95.38", "142.251.222.238", "172.240.127.234", "18.67.108.148", "104.18.0.22", "23.111.84.220", "142.250.195.104", "91.108.99.52" ], "asns": [ "16509", "15169", "7979", "13335", "47583" ], "countries": [ "US", "NL", "AU" ], "doc_hash": "c826e244de50765ac0788303800c16bb273a4d3b3a735931d3a2a1e0f44e9459", "script_hashes": [ "4928d07ec66d3d9d66effa8954bf8935ea92875fc61d6bf7aaf11dcf9c30c674" ], "globals": [ "gtag", "dataLayer", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal", "BoxIconElement", "EpSxf_VgG_fVkaJc", "xfContentLocker", "__cfRLUnblockHandlers", "CPBContentLocker", "xfLock", "xfGetFeedURL", "xfGetIframeURL", "xfGetIframeHTML", "xfUnlock", "xfOfferComplete", "xfOffersComplete", "xfCheckForLead", "xfComplete", "CPABuildLock", "CPABuildGetFeedURL", "CPABuildGetIframeURL", "CPABuildGetIframeHTML", "CPABuildUnlock", "CPABuildOfferComplete", "CPABuildOffersComplete", "CPABuildCheckForLead", "CPABuildComplete", "_RH", "_Vm", "_uj", "_Ew", "_HW", "_oy", "_Jf", "_Mz", "_EQ", "_ZU", "_lL" ], "cookies": [ "_ga", "_ga_8ZSC7L3H5E" ], "tls": { "san": [ "rboxe.com", "www.rboxe.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "rboxe.com", "protocol": "TLS 1.3", "valid_to": "2026-11-30T17:14:32Z", "valid_from": "2026-09-01T17:14:33Z" }, "domain_age_days": 2448, "apex_age_days": 2448, "tls_age_days": 49, "tls_valid_days": 89, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "roblox" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Roblox" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "hcdn", "content-type": "text/html", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T01:46:59Z", "uuid": "a1991ffb-62aa-4279-8988-93fd5542cf85", "scanned_at": "2026-10-21T01:46:03Z", "final_url": "https://rboxe.com/", "status": 200, "history": [ { "url": "https://rboxe.com/", "status": 200 } ], "dom_hash": "1efde70532137864aca09b29e339305bcc3918ad93327dff3fb67102264c6bd7", "doc_hash": "c826e244de50765ac0788303800c16bb273a4d3b3a735931d3a2a1e0f44e9459", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rboxe.com", "type": "A", "value": "195.200.9.116" }, { "name": "rboxe.com", "type": "A", "value": "185.77.97.211" }, { "name": "rboxe.com", "type": "AAAA", "value": "2a02:4780:35:f805:2ca9:c9d4:c484:b0f7" }, { "name": "rboxe.com", "type": "AAAA", "value": "2a02:4780:26:d05f:d543:37c1:500a:fb26" } ], "dnssec_valid": false, "ip": "195.200.9.116", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2026-07-03T19:01:58Z", "updated": "2026-07-29T11:58:43Z", "expires": "2027-07-03T19:01:58Z", "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:17:34Z", "analysis_at": "2026-10-21T02:15:18Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "HOSTINGER operations, UAB", "created": "2026-07-03T19:01:58Z", "expires": "2027-07-03T19:01:58Z", "updated": "2026-10-21T02:08:28Z", "first_seen": "2026-07-03T19:59:16Z", "dns": [ { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4a:f994:816f:499a:5e03:11b8" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" }, { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "ns2.dns-parking.com" }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4c:61c5:d665:74b:67dc:826e" }, { "ttl": 21600, "type": "NS", "value": "ns1.dns-parking.com" }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "ns1.dns-parking.com" }, { "ttl": 60, "type": "A", "value": "145.223.124.110" }, { "ttl": 60, "type": "A", "value": "88.223.87.182" } ], "dns_at": "2026-09-01T19:18:14Z", "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "rboxe.com", "www.rboxe.com" ], "issuer": "Let's Encrypt / YE2", "serial": "52de943ee5aa57265226a88b48042249847", "sha256": "a95d15ebdbdfee7552004914c6dc1dfc05366a2b25a53f9df96cf2fba48545e9", "subject": "rboxe.com", "valid_to": "2026-11-30T17:14:32Z", "valid_from": "2026-09-01T17:14:33Z" }, "whois": { "registrar": "HOSTINGER operations, UAB", "registrar_iana_id": "1636", "registrar_url": "http://www.hostinger.com", "created": "2026-07-03T19:01:58Z", "updated": "2026-10-21T02:08:28Z", "expires": "2027-07-03T19:01:58Z", "status": [ "clientHold", "clientTransferProhibited" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client hold" ], "events": { "registration": "2026-07-03T19:01:58Z", "registrar expiration": "2027-07-03T19:01:58Z", "last update of RDAP database": "2026-10-21T02:08:28Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T01:47:17Z", "mail_config": { "mx": [ "mx1.hostinger.com", "mx2.hostinger.com" ], "spf": "v=spf1 include:_spf.mail.hostinger.com ~all", "spf_lookups": 3 }, "caa_records": { "domain": "rboxe.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "social_tags": { "title": "Buy Robux" }, "trackers": { "requests": 15, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Amazon CloudFront", "company": "Amazon", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "unpkg", "company": "unpkg", "category": "Hosting", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js", "https://pl31632616.profitableratecpmnetwork.com/d5/a8/54/d5a8541daf44a020601a856c269a48cc.js", "https://d1mikxzr3lp4va.cloudfront.net/5f070a5.js", "https://pl31615488.profitableratecpmnetwork.com/fa/00/8a/fa008a8bfcf6e793216aebc3807ff4bd.js", "https://unpkg.com/boxicons@2.1.4/dist/boxicons.js" ], "upgrade_insecure": true, "third_party_scripts": 5 }, "status": { "up": true, "code": 200, "timings": { "dns": 5, "tls": 62, "wait": 33, "connect": 31, "download": 1 }, "response_ms": 132 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 2429, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "162.159.24.201", "host": "ns1.dns-parking.com" }, { "ip": "162.159.25.42", "host": "ns2.dns-parking.com" } ], "zone": "rboxe.com" }, "cookies": { "cookies": [ { "name": "_ga" }, { "name": "_ga_8ZSC7L3H5E" } ] }, "location": { "ip": "2a02:4780:42:42f5:4178:9c1f:4b19:6b52", "asn": "47583", "org": "Hostinger International Limited", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "rboxe.com" }, "dns": { "A": [ "92.113.16.159", "92.113.23.215" ], "MX": [ "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}", "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}" ], "NS": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "SOA": "{\"nsname\": \"ns1.dns-parking.com\", \"hostmaster\": \"dns.hostinger.com\", \"serial\": 2026101501, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ], "AAAA": [ "2a02:4780:44:388:5711:35a5:a38a:70c9", "2a02:4780:42:42f5:4178:9c1f:4b19:6b52" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": "upgrade-insecure-requests", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a02:4780:44:388:5711:35a5:a38a:70c9", "family": 6 }, "redirects": { "chain": [ "https://rboxe.com" ] }, "tech_stack": { "technologies": [ "Vue.js", "Unpkg", "Google Analytics", "Cloudflare Rocket Loader", "CPABuild", "Hostinger CDN", "Hostinger", "HTTP/3" ] }, "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2026-07-03T19:01:58Z", "updated": "2026-07-29T11:58:43Z", "expires": "2027-07-03T19:01:58Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] }, "headers": { "headers": { "server": "hcdn", "content-type": "text/html", "content-security-policy": "upgrade-insecure-requests" } } } } ```