rbxhar[.]site

This domain, rbxhar.site, is flagged as an active phishing site targeting user credentials. Registered on April 17, 2026, through NameCheap, Inc., it resolves to 162.254.39.203, hosted on infrastructure associated with Namecheap. The page title 'Create' aligns with common credential harvesting themes, though the exact content and targeted brand have not been confirmed through technical analysis. Infrastructure analysis reveals the use of PHP, LiteSpeed, SweetAlert2, and jsDelivr, which are frequently leveraged in phishing campaigns for dynamic content delivery and user interaction manipulation. The domain is currently active, returning an HTTP 200 status, and is blocked by at least one security vendor. It appears on one security blocklist, and two of 94 security vendors on VirusTotal have flagged it as malicious. The SSL certificate, issued by Sectigo Limited, is valid for public server authentication but does not mitigate the phishing risk. MX records point to mx1-hosting.jellyfish.systems and a secondary host, suggesting potential email infrastructure for follow-up phishing or spam campaigns. Defenders should treat this domain as high-risk. Block access at the network level, monitor for connections to 162.254.39.203, and investigate any user interactions with the site. The use of Namecheap-hosted infrastructure and lightweight technologies like SweetAlert2 and jsDelivr may indicate a low-cost, disposable phishing operation. No specific brand impersonation has been confirmed, but the domain naming convention and page title suggest a focus on platforms involving user account creation, such as gaming or social media. Further analysis of the site's content is recommended to determine the exact phishing kit or targeted service.