rbox10[.]netlify[.]app

The domain rbox10.netlify.app has been identified as a brand impersonation infrastructure targeting the Roblox platform. Analysis indicates the site is currently active and configured to mimic legitimate Roblox branding elements, consistent with high-confidence impersonation behavior. The page title explicitly presents as “Roblox,” reinforcing deceptive intent aimed at credential harvesting or user redirection.

Technical intelligence confirms multiple malicious indicators: the domain is flagged by 19 of 95 VirusTotal security vendors, and it appears on 2 independent security blocklists (PhishDestroy and PhishingDB). It is hosted via Netlify infrastructure and resolves to IPv6 address 2a05:d014:58f:6200::258, geolocated in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), indicating valid encryption but not legitimacy of content. No verified domain creation date is available in the provided intelligence set.

Current status remains active, indicating ongoing exposure risk. The combination of high detection rate, confirmed brand impersonation, and multiple blacklist appearances suggests elevated threat severity. Users and security systems should treat this domain as hostile infrastructure and implement immediate blocking at DNS, proxy, and endpoint layers. Credential entry attempts should be considered compromised by design, and any traffic to this domain should be logged, investigated, and correlated with potential phishing campaigns targeting Roblox users.