bloxtools[.]ink

PhishDestroy identifies the domain bloxtools.ink as a live Roblox account phishing page currently under active investigation. The threat involves the impersonation of the official Roblox login portal to harvest user credentials. The campaign is classified as an active phishing operation with a risk level currently under review.

This domain was flagged by 4 of 95 VirusTotal vendors at the time of analysis, indicating it remains undetected by most signature-based defenses. It was registered through NAMECHEAP INC and is protected by a Let's Encrypt SSL certificate. The domain resolves to IP address 188.114.97.3 and was created on February 26, 2026. As of this report, it is not listed on any major public blocklists and maintains a clean historical reputation with no prior security incidents on record.

While the immediate risk is categorized as under investigation due to low detection coverage and recent domain age, users should exercise extreme caution. PhishDestroy recommends avoiding all interactions with bloxtools.ink and blocking the associated IP address 188.114.97.3 at the network perimeter. Organizations are advised to update browser blocklists and SIEM rules with this domain and IP. Users who may have entered credentials on this page should immediately change their Roblox password and enable two-factor authentication. Monitor accounts for unusual activity and report any unauthorized access to Roblox support.