# www.roblox-secure.com — SUSPICIOUS

> PhishDestroy identifies roblox-secure.com as an active Robux credential phishing domain with a 1/95 VirusTotal detection rate. Check the full report.

## Summary
PhishDestroy identifies www.roblox-secure.com as an active credential phishing domain impersonating Roblox’s security portal. The domain hosts a spoofed login page designed to harvest user credentials under the guise of a Robux security update. No known drainer kit or advanced obfuscation techniques were detected during initial analysis, but the page structure closely mirrors legitimate Roblox login flows to maximize deception.  

This domain was flagged with a VirusTotal detection score of 1 out of 95 security vendors as of the latest scan. Technical indicators include registration through NAMECHEAP INC, resolution to IP address 216.198.79.1, and issuance of a Let’s Encrypt SSL certificate. The domain was created on March 22, 2026, indicating a highly recent campaign with minimal operational history. It has not yet been blocklisted by major services such as Google Safe Browsing, increasing its potential reach across unsuspecting users.  

The domain remains active at the time of writing with an elevated risk profile due to its targeted branding and recent registration. Immediate response actions should include domain takedown requests to NAMECHEAP and SSL revocation via Let’s Encrypt. Users are advised to avoid interacting with any links or pages under this domain and to verify login portals directly through official Roblox channels. While current detection is low, the risk of credential theft remains substantial due to the domain’s convincing mimicry of legitimate Roblox infrastructure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-22 15:35:19
- Registrar: NAMECHEAP INC
- IP: 216.198.79.1

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/50ca5cfb-d4bb-459f-9ff2-a96e875210bf
- PhishDestroy: https://phishdestroy.io/domain/www.roblox-secure.com/
- LLM endpoint: https://phishdestroy.io/domain/www.roblox-secure.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/www.roblox-secure.com/
Last updated: 2026-03-22