rbxtools[.]digital

This domain, rbxtools.digital, is actively engaged in credential phishing targeting users of the Roblox platform. The site masquerades as a legitimate "Roblox Tools Hub," presenting itself as a resource for game tools or enhancements. Analysis indicates the infrastructure is designed to harvest login credentials, likely through fraudulent login prompts or account verification forms that mimic Roblox’s official interface. The use of social engineering tactics, such as offering in-game benefits or exclusive tools, increases the likelihood of user engagement and subsequent credential compromise. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on April 17, 2026, through Global Domain Group LLC, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 172.67.184.219 and is protected by Cloudflare, a common tactic to obscure the true origin of the phishing server and evade detection. The site employs a Let’s Encrypt SSL certificate, which provides HTTPS encryption but does not validate the legitimacy of the content. VirusTotal reports that 12 out of 95 security vendors have flagged this domain as malicious, while it appears on one security blocklist and is assigned a trust score of 0/100 by Gridinsoft. Additional technologies detected include Cloudflare Browser Insights and HTTP/3, further indicating an attempt to mimic legitimate web infrastructure. Users who have visited rbxtools.digital or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset the password for the affected Roblox account and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on the Roblox account to add an additional layer of security. Monitor the account for unauthorized activity, such as changes to personal information, unauthorized purchases, or messages sent to other users. If financial information was entered, contact the relevant financial institution to report potential fraud and monitor for unauthorized transactions. Additionally, scan the device used to access the site for malware, as phishing pages may deploy malicious scripts or redirect to exploit kits. Report the domain to Roblox’s security team and consider submitting it to additional threat intelligence platforms to aid in broader detection efforts.