rbx15[.]netlify[.]app

Analysis of rbx15.netlify.app indicates that the domain is currently offline but was previously serving a page titled "Get robux," a classic lure for Roblox users seeking in‑game currency. The site was hosted on Netlify, as evidenced by the detected Netlify platform and the presence of HTTP Strict Transport Security (HSTS) headers, and its SSL certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, confirming a valid TLS layer at the time of operation. DNS resolution points to IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS14618) and is located in the United States. Nameserver records list dns1.p04.nsone.net and dns2.p04.nsone.net, consistent with Netlify’s default configuration.

The domain appears on one external security blocklist and is specifically listed by PhishDestroy, reinforcing its malicious classification. VirusTotal scans returned 15 positive detections out of 95 security vendors, indicating a moderate consensus among scanning engines that the host was malicious. An HTTP request to the domain now returns a 404 status, consistent with the reported offline state.

Defenders should continue to block the domain at perimeter defenses, monitor for any re‑registration attempts, and consider adding the associated IP address to deny lists, especially for environments where Roblox traffic is uncommon. Network traffic to the Netlify infrastructure from internal users should be inspected for anomalous patterns, and any credential‑theft alerts tied to "robux" or Roblox‑related terminology should be correlated with this indicator. Because the site is taken offline, active remediation is limited to containment and future‑watching, but the existing intelligence provides sufficient confidence to treat rbx15.netlify.app as a confirmed phishing resource.