roblox[.]com[.]py

This domain, roblox.com.py, is identified as a brand impersonation threat targeting Roblox, a widely recognized gaming platform. Analysis of the page title, Catalog - Roblox, confirms the intent to deceive users by replicating the legitimate Roblox catalog interface. No explicit drainer kit signatures were detected in initial scans, though the domain’s infrastructure aligns with credential harvesting campaigns commonly associated with phishing operations. Infrastructure analysis reveals critical technical indicators: the domain is flagged by 23 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. It was registered through Gohost (ASN: 208191) and resolves to the IP address 91.231.222.76, hosted under AS36680 (Netiface LLC) in Slovenia. The SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal assurance, as it is commonly exploited in phishing campaigns. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently marked as offline. Google Safe Browsing status was not explicitly provided, but the domain’s inclusion on multiple blocklists suggests prior malicious activity. At present, roblox.com.py has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the elevated risk persists due to the domain’s prior use in phishing operations and its association with known malicious infrastructure. Users who may have interacted with the site are advised to reset credentials for Roblox and any other accounts where identical passwords were reused. Organizations should monitor for related domains registered under similar patterns, particularly those using country-code top-level domains (ccTLDs) to impersonate legitimate brands. Proactive blocking of the IP address 91.231.222.76 and associated ASN is recommended to mitigate residual risk.