rbxcashouts[.]roblox-635[.]workers[.]dev

PhishDestroy identifies rbxcashouts.roblox-635.workers.dev as an active phishing site designed to steal Roblox account credentials. Scammers trick players into entering login details by promising free in-game currency or cashouts, then harvesting credentials for resale or account takeover. The domain leverages Cloudflare’s infrastructure and a Let’s Encrypt SSL certificate to appear legitimate, aiming to bypass browser warnings. This domain was flagged by 9 out of 95 VirusTotal security vendors, indicating widespread recognition as malicious. It resolves to IP address 188.114.96.3 and was registered through Cloudflare, Inc., a common tactic used by threat actors to obscure their true location and hosting provider. The use of workers.dev subdomains is a known tactic by phishing operators to host short-lived scam pages under trusted domains. If you visited this site, stop using the same password anywhere else. Run a malware scan on your device and enable two-factor authentication on all gaming and email accounts. Do not enter any credentials or payment details. Report the domain to your antivirus provider and avoid clicking any suspicious links in the future. Always verify cashout offers directly through official Roblox platforms.