rbxtools[.]st

This domain was registered through the ST Registry on March 06, 2026 and resolved to IP 151.247.193.142, which is advertised as belonging to AS399486 (12651980 Canada Inc.) and geolocated in France. The authoritative nameservers ns1.eggywall.cc and ns2.eggywall.cc were observed at the time of resolution. An HTTPS service presented a valid Let’s Encrypt certificate (issuer E8) and responded with HTTP status 200, delivering a page whose title is exactly “rbxtools.st”. No additional content analysis is available.

The site was classified as a gaming‑related scam; it appeared on a single external blocklist and was subsequently blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigned a trust score of 1 out of 100. VirusTotal scans reported 16 detections out of 94 submitted security vendors, indicating a moderate level of consensus among scanners. The domain is currently taken offline, which limits real‑time observation but does not remove the historical indicators.

Defenders should continue to enforce outbound filtering for the resolved IP address, update internal blocklists with the domain and its associated nameservers, and monitor for any reuse of the hosting infrastructure. Because the site employed a legitimate TLS certificate, reliance on certificate validity alone is insufficient; detection logic should incorporate the observed HTTP response, low trust score, and the specific malware‑vendor detection count. Further investigation is recommended to determine whether the underlying server is being repurposed for additional phishing campaigns, and to verify that any credential‑stealing forms previously hosted are no longer reachable.