www--roblox[.]co

This domain, www.www--roblox.co, is actively impersonating the Roblox gaming platform as part of a confirmed phishing operation. Analysis indicates the domain was registered on April 12, 2026, and currently resolves to the IP address 188.114.96.3, which is hosted on infrastructure belonging to CloudFlare, Inc. in Canada. The site returns an HTTP 200 status code and displays a 'Site Maintenance' page title, a common tactic used to delay detection while maintaining the appearance of legitimacy. Security vendor assessments reveal that 10 out of 95 engines on VirusTotal flag this domain as malicious, with Google Safe Browsing specifically classifying it under 'SOCIAL_ENGINEERING.' The domain appears on one security blocklist and has been documented in a single threat intelligence pulse on AlienVault OTX. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as phishing sites frequently use valid certificates to evade basic HTTPS warnings. Gridinsoft assigns the domain a trust score of 0 out of 100, further corroborating its malicious classification. The domain is explicitly categorized as a gaming scam, targeting users of the Roblox platform. While the 'Site Maintenance' page may suggest temporary unavailability, this is likely a deception to reduce suspicion during periods of low traffic or to prepare for a larger campaign. The use of CloudFlare infrastructure complicates attribution and takedown efforts, as the service is often leveraged to mask the true origin of malicious traffic. Defenders should treat this domain as an active threat. Network-level blocking is recommended, particularly for endpoints associated with gaming or educational environments where Roblox is commonly accessed. Monitoring for connections to 188.114.96.3 or DNS queries for www.www--roblox.co can help identify compromised systems. Given the domain's recent registration and ongoing activity, it is likely to remain a threat vector until formally disrupted or sinkholed.