rbxmodapk[.]com

Analysis of rbxmodapk.com shows a newly registered domain created on 18 August 2025 and currently inactive. The domain resolves to 104.21.54.137, an address owned by Cloudflare (AS13335) located in the United States. Registration was performed through Dynadot LLC and the authoritative name servers are annabel.ns.cloudflare.com and cleo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. No TLS certificate is present, so the site does not serve traffic over HTTPS. The page title observed in prior scans references “Roblox Mod APK v2.692.843 (Mod Menu, Unlimited Robux)”, which aligns with a gaming‑related impersonation of the Roblox brand.

The threat is classified as a Gaming Scam and has been blocked by PhishDestroy. Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX lists the domain in 15 separate threat intelligence pulses. VirusTotal records 16 detections out of 95 scanning engines, reinforcing the malicious assessment. The domain appears on one external security blocklist, and PhishDestroy has already taken the site offline. While the current HTTP status is unavailable due to the offline state, the combination of low trust rating, multiple vendor detections, and the explicit Roblox‑related page title provides strong evidence that the domain was used to lure users seeking unauthorized game modifications.

Defenders should continue to block the IP address 104.21.54.137, add rbxmodapk.com to local deny lists, and monitor Dynadot‑registered domains for similar naming patterns. Ongoing surveillance of Cloudflare‑hosted infrastructure is advised, as the service can be rapidly re‑provisioned for new malicious domains. The lack of an SSL certificate suggests the operator relied on non‑encrypted HTTP, which may simplify detection by TLS‑inspection tools.