borobudur777[.]com

This domain is flagged as an elevated-risk phishing infrastructure specifically designed to harvest Roblox account credentials through deceptive in-game creativity challenges. Analysis indicates the site masquerades as a legitimate gaming platform, leveraging social engineering tactics to trick users into submitting login details under the guise of skill testing or exclusive content access. The threat type is classified as credential theft phishing, with a clear focus on the Roblox gaming community. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain borobudur777.com resolves to IP address 181.215.205.14, hosted on AS21859 (Zenlayer Inc) in the United Arab Emirates. It was registered on October 17, 2025, through NameSilo, LLC, with an unusually recent creation date suggesting potential disposable infrastructure. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The page title explicitly references 'BOROBUDUR 777 Uji Kreativitas Dalam Roblox,' confirming its targeting of Indonesian-speaking Roblox users. Mitigation requires immediate action from both end users and network administrators. Users should verify all Roblox-related communications through official channels and enable multi-factor authentication on gaming accounts. Network-level protections should include DNS filtering to block resolution of this domain and its associated IP address. Security teams should monitor for credential reuse patterns, as stolen Roblox accounts are frequently repurposed for secondary attacks or sold on underground markets. The domain's current offline status does not eliminate risk, as phishing infrastructure often reappears under similar naming conventions or IP ranges. Organizations should treat this as part of a broader credential harvesting campaign targeting gaming platforms.