robuxvault[.]vercel[.]app

This domain, robuxvault.vercel.app, poses a brand impersonation threat targeting Roblox users by presenting a fraudulent Robux redemption page. The site mimics Roblox’s official reward system, tricking users into entering account credentials or payment details under the guise of redeeming free Robux. The page title, 'Roblox Redeem code Robux | Fast & Secure Robux,' reinforces the deception by closely resembling legitimate Roblox messaging, increasing the likelihood of user engagement. Analysis indicates the domain was hosted on infrastructure associated with Vercel Inc. and resolved to the IP address 64.29.17.3, located in the United States under AS16509 (Amazon.com, Inc.). Security vendors on VirusTotal flagged the domain at a rate of 17/95, with two additional security blocklists (PhishDestroy and PhishingDB) listing it as malicious. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. The domain has since been taken offline, but its prior activity warrants scrutiny. Users who visited robuxvault.vercel.app should immediately change their Roblox account passwords and enable multi-factor authentication if not already active. Any credentials or payment details entered on the site should be considered compromised, and users are advised to monitor their accounts for unauthorized transactions. If financial information was provided, affected individuals should contact their financial institution to report potential fraud. Organizations should update their blocklists to include this domain and its associated indicators to prevent future access.