100k4yo[.]netlify[.]app

100k4yo.netlify.app was registered on December 03, 2025 through Netlify and currently resolves to the IPv4 address 98.84.224.111, which belongs to AS14618 Amazon.com, Inc. and is geolocated in the United States. The site presents an HTTPS endpoint using a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, and HTTP requests return status code 200. Automated analysis identifies the hosting platform as Netlify, the presence of HTTP Strict Transport Security, and the use of the DTScout library. The page title observed is "Get robux", and the campaign targets the Roblox brand, classifying it as a brand impersonation gaming scam. VirusTotal scans show 21 of 95 security vendors flagging the domain as malicious. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The domain is listed on two public blocklists and is actively blocked by PhishDestroy and PhishingDB. The investigation status is active and the risk level is high. Current intelligence does not include a full content snapshot beyond the title, so the exact phishing flow and credential collection mechanisms remain unknown. Defenders should immediately block the domain at network and endpoint layers, monitor DNS queries for the associated IP and ASN, and consider sinkholing the host to disrupt traffic. Ongoing observation of the certificate and any changes to the hosting configuration is recommended to detect possible migration or repurposing.