roblox[.]gr

The domain roblox.gr is currently active and has been classified as a brand‑impersonation campaign targeting the Roblox brand. The site presents the page title “Roblox”, matching the targeted brand, and is listed under the threat type “gaming”. Its risk level remains under investigation, reflecting limited public detection while the infrastructure indicates purposeful abuse of the Roblox name.

Infrastructure analysis shows the domain resolves to the IPv4 address 128.116.44.3, which resolves to a host located in Germany and is announced by AS22697, an autonomous system owned by Roblox. The TLS certificate is issued by Amazon RSA 2048 M01, and the site employs Amazon Web Services, Amazon S3 storage, AngularJS, Sectigo, and enforces HTTP Strict Transport Security. An HTTP 301 redirect is observed, and no nameserver information is publicly disclosed.

Open‑source intelligence indicates the domain appears on a single security blocklist and has been referenced in two AlienVault OTX threat‑intelligence pulses. Gridinsoft assigns a trust score of 0 out of 100, and the site is currently blocked by the PhishDestroy service. VirusTotal scans to date have returned 0 detections out of 95 engines, which does not constitute a safety assurance. The low trust score and presence on blocklists suggest a high likelihood of malicious intent despite the lack of detection signatures.

Defenders should prioritize the inclusion of roblox.gr in URL filtering and DNS‑based blocking policies, especially for environments where Roblox accounts are used. Continuous monitoring of the IP address 128.116.44.3 and related ASN activity is advised, as well as periodic re‑scanning with multi‑engine services to capture any emerging indicators. Incident response teams should treat any credential or payment data submitted to this domain as potentially compromised and advise affected users to change their Roblox passwords immediately.