r[.]oblox[.]com[.]ru

This report documents the investigation into the domain r.oblox.com.ru, which has been identified as a social media phishing site. The domain was registered through IDNIC-SMK-ADISANGGORO-ID, an entity associated with ASN 141892, and is hosted in Indonesia by CV Andhika Pratama Sanggoro. The SSL certificate for this domain is issued to localhost, indicating a lack of proper security measures and potentially raising suspicions among cautious users. As of the report date, July 23, 2026, the domain has been taken offline and is blocked by PhishDestroy, a known cybersecurity service.

Despite its current offline status, 14 of 95 security vendors flagged the domain as malicious, suggesting that it posed a significant threat when active. The domain resolves to the IP address 103.186.31.94, and it appears on one security blocklist, further corroborating its suspicious nature. The page title of the domain is simply 'r.oblox.com.ru', which does not provide any additional context about the content or the target of the phishing campaign.

Defenders should remain vigilant and ensure that their systems are configured to block this domain to prevent potential user exposure. The exact content and target of the phishing site have not been fully analyzed, but the combination of a flagged domain, localhost SSL certificate, and blocklist presence indicates that it was likely involved in a social media phishing campaign. Network administrators and security teams should monitor for any attempts to access this domain and consider implementing additional layers of protection such as DNS filtering and user education on recognizing phishing attempts.