roblox1[.]netlify[.]app

This domain, roblox1.netlify.app, is identified as a credential phishing resource specifically targeting users of the Roblox platform through brand impersonation. Analysis confirms the domain is currently offline, though prior activity indicates an elevated risk level due to its fraudulent intent. The site presented itself as an official Roblox login portal, designed to harvest user credentials through deceptive input forms. Infrastructure analysis reveals the domain was flagged by 21 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Name.com, Inc. (Netlify) on February 21, 2026, and resolved to the IP address 35.157.26.135, hosted within the Amazon.com, Inc. autonomous system (AS16509) in Germany. The domain appeared on one security blocklist and was proactively blocked by at least one threat intelligence feed. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provided a false sense of legitimacy to unsuspecting users. Given the domain’s current offline status, no active threat is present; however, the infrastructure and tactics observed align with persistent phishing campaigns. Organizations and users are advised to monitor for similar domains leveraging cloud hosting providers and brand impersonation techniques. Network administrators should review logs for connections to 35.157.26.135 and implement blocklist updates to prevent access to related malicious resources. End-users should verify domain authenticity before entering credentials and enable multi-factor authentication where available to mitigate credential theft risks.