rbx025k[.]blogspot[.]com[.]es

On July 23, 2026, the domain rbx025k.blogspot.com.es was observed hosting a phishing page titled “Get Robux”. The page returns an HTTP 302 redirect, indicating that visitors are automatically sent to a secondary location. DNS resolution points to the IPv6 address 2a00:1450:4001:813::2001, which belongs to Google LLC (ASN 15169) and is geolocated in Germany. The domain is registered through Google, confirming the same ASN. The SSL certificate presented is issued by Google Trust Services under the WE2 intermediate, providing a valid TLS connection but offering no indication of legitimacy for the hosted content.

Infrastructure analysis shows the site leverages Blogger as the content management system and utilizes Java, Python, OpenGSE, and HTTP/3, reflecting a typical web‑stack for malicious actors exploiting legitimate hosting services. Threat intelligence indicates the domain appears on a single blocklist, PhishDestroy, and has been flagged by 14 of 95 security vendors on VirusTotal, demonstrating moderate detection consensus. No additional blocklists or safe‑browsing entries were identified. The high‑risk classification derives from the combination of active status, confirmed phishing page title, and the use of a reputable hosting provider to obscure malicious activity.

Uncertainty remains regarding the exact payload delivered after the redirect and whether the site collects credentials or distributes malware; the current data set does not include payload analysis or user‑interaction details. Defenders should block the domain at network perimeters, update URL filtering rules to include the IPv6 address, and monitor for any related subdomains or similar Blogger‑hosted URLs. Continuous re‑scanning of the domain on multi‑engine services is advised to capture any changes in detection counts. Organizations employing web‑proxy or DNS‑filtering solutions should add rbx025k.blogspot.com.es to their deny lists to mitigate exposure to this active phishing infrastructure.