rbxflip[.]xyz

This domain, rbxflip.xyz, is identified as a credential phishing site targeting users of the Roblox gaming platform. Analysis indicates the site was designed to mimic legitimate Roblox login pages, tricking victims into entering their account credentials. Once submitted, these credentials are harvested by threat actors, enabling unauthorized access to accounts, theft of in-game currency, and potential exploitation of linked payment methods. The site poses an elevated risk due to its targeted nature and the high value of compromised gaming accounts in underground markets. Infrastructure analysis reveals the domain was registered on March 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. The site resolved to the IP address 188.114.97.3, which is part of a network known for hosting phishing infrastructure. Detection data from VirusTotal shows that 8 out of 95 security vendors flagged rbxflip.xyz as malicious, corroborating its classification as a phishing threat. Additionally, the domain appears on one security blocklist and has been assigned a trust score of 0/100 by independent analysis platforms. The use of Cloudflare and HTTP/3 further suggests an attempt to evade detection and improve site performance, common tactics in phishing campaigns. Users who visited rbxflip.xyz or entered credentials on the site should take immediate action to secure their accounts. First, change the password for the affected Roblox account and enable multi-factor authentication if not already active. Review the account for unauthorized activity, such as changes to personal information, unauthorized purchases, or messages sent to other users. If payment methods are linked to the account, monitor bank statements for suspicious transactions and consider removing or updating payment details. It is also recommended to scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Finally, report the incident to the platform’s support team to assist in mitigating further abuse.