geturrbx1[.]netlify[.]app

Analysis of the domain geturrbx1.netlify.app indicates a high‑risk brand‑impersonation campaign targeting Roblox. The site was registered on 21 June 2026 and is hosted on Netlify, as reflected by the Netlify technology fingerprint and the presence of a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate. DNS resolution points to the IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The HTTP response returns status code 200 and the page title is “Roblox”, confirming the intended brand target. Security assessments show a Gridinsoft trust score of 0 / 100 and the domain is listed on a single blocklist, with PhishDestroy already blocking it. VirusTotal scans have triggered detections by two of ninety‑one vendors, reinforcing the malicious classification. Detected client‑side libraries include jQuery from a CDN, HSTS enforcement, and Google Analytics, all typical of Netlify‑hosted pages. Nameserver information is not available in the current data set, and no additional content analysis has been performed, leaving the exact phishing payload unknown. Defenders should add the domain to URL filtering and DNS blocklists, monitor traffic to the associated IP range, and treat any credential‑submission attempts to Roblox‑related services as compromised. Continuous observation is advised to detect any future changes in the site’s behavior or additional detections.