rbxtools[.]io[.]vn

PhishDestroy identifies rbxtools.io.vn as an active domain impersonating Roblox login pages to steal user credentials. This domain resolves to 103.255.237.233 and operates under a Let’s Encrypt SSL certificate, attempting to appear legitimate. With 12 out of 95 VirusTotal security vendors flagging it as malicious, the domain demonstrates clear malicious intent. Its infrastructure suggests a coordinated effort to deceive users into surrendering account access or payment information linked to Roblox accounts.

Evidence further confirms the threat: the domain was created recently and currently appears on multiple blocklists due to widespread user reports. VirusTotal’s detection rate stands at 12/95, indicating widespread suspicion among security tools. The IP address is known for hosting multiple fraudulent platforms, and the use of a legitimate SSL certificate is a common tactic to bypass browser warnings and gain user trust. Combined with the generic Vietnamese top-level domain (.vn), this site likely targets non-English-speaking users or leverages regional trust to lower suspicion.

If you have visited rbxtools.io.vn and entered any information, immediately change your Roblox password and enable two-factor authentication. Scan your device for malware using reputable antivirus software, and review account activity for unauthorized transactions or access. Do not reuse passwords across platforms. For verification and real-time safety checks, use PhishDestroy’s browser extension or scanner to confirm domain legitimacy before submitting sensitive data. Staying vigilant and verifying unknown domains can prevent credential theft and financial loss.