# PhishDestroy threat dossier — rbxlimited.blogspot.com ================================================================ Fetched: 2026-07-18 04:03:03 UTC Canonical: https://phishdestroy.io/domain/rbxlimited.blogspot.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 57/100 (PhishDestroy scoring — see methodology below) Targeted brand: Google ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 192.178.183.132 (DE, Frankfurt am Main) ASN: ASAS15169 GOOGLE - Google LLC, US Hosting org: AS15169 Google LLC Registrar: Google Blogger Nameservers: NS_NOT_FOUND Page title: RBX O HTTP response: 404 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-11 16:12:55 UTC (by PhishDestroy tracker) Last verified: 2026-07-18 04:20:39 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5185-496c-71ed-b6d7-258e37e31cc6/ Wayback Machine: https://web.archive.org/web/*/rbxlimited.blogspot.com crt.sh CT logs: https://crt.sh/?q=%25.rbxlimited.blogspot.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rbxlimited.blogspot.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/rbxlimited.blogspot.com URLhaus: https://urlhaus.abuse.ch/host/rbxlimited.blogspot.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-11 16:43:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] rbxlimited.blogspot.com: Active Roblox Credential Phishing Site This domain, rbxlimited.blogspot.com, is currently flagged as a generic phishing site under active investigation. Analysis indicates it is designed to harvest Roblox account credentials, likely leveraging social engineering tactics to mimic legitimate login portals. The infrastructure is hosted on Google Blogger, a platform frequently abused for low-cost phishing deployment due to its accessibility and trusted SSL certificates. No specific drainer kit signatures have been identified at this stage, but the domain’s behavioral patterns align with credential theft campaigns targeting gaming platforms. Technical indicators reveal the domain resolves to the IP address 142.251.20.132, associated with Google’s infrastructure. VirusTotal reports 0/95 detections, suggesting the domain has not yet been widely flagged by security vendors. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy. Registration details confirm the domain is hosted through Google Blogger, with no independent WHOIS records available. The domain appears on a single security blocklist, indicating early-stage detection. No historical creation date is publicly accessible due to the platform’s hosting model, but its recent activity suggests a short operational lifespan. Current status remains active, with the domain still serving phishing content at the time of analysis. It has been blocked by at least one security entity, though the lack of broader detection underscores its evasion tactics. The primary risk lies in its ability to bypass initial scans, potentially exposing users to credential theft. Mitigation requires immediate blocking of the domain and IP at the network level. Users are advised to verify the authenticity of Roblox-related login pages, enable multi-factor authentication, and report suspicious URLs to platform-specific abuse channels. Continued monitoring is necessary to assess whether additional infrastructure or redirect chains are involved. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: d7fc1da3f0d85bd1777c84d42b1db20b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rbxlimited.blogspot.com/ JSON API: https://api.destroy.tools/v1/check?domain=rbxlimited.blogspot.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 179,932 domains (51,339 alive under monitoring, 128,593 confirmed takedowns/dead). Site: https://phishdestroy.io