r[.]oblox[.]com[.]et

Analysis of r.oblox.com.et shows that the domain is currently active and returns an HTTP 302 status, a behavior commonly used to redirect unsuspecting users to malicious payloads or credential‑stealing pages. The domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy, indicating that defensive feeds have identified it as a threat. VirusTotal scans have recorded detections from 21 of 91 security vendors, providing independent corroboration of malicious intent.

No additional infrastructure details such as registrar, IP address, ASN, or SSL certificate information are available in the supplied intelligence, and the page title or any brand‑specific references have not been disclosed, leaving the exact phishing lure and target brand ambiguous. The observable evidence therefore confirms the domain’s involvement in a credential‑harvesting campaign, but the lack of deeper context limits attribution to a specific brand or phishing kit.

Defenders should immediately add r.oblox.com.et to URL filtering and web‑gateway blocklists, monitor DNS queries for the domain, and consider sinkholing or null‑routing the associated IP space if it becomes known. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in detection scores, and any future discovery of hosting or payload details should be incorporated into threat‑intel feeds to improve detection accuracy.