roblox-login-user[.]github[.]io

Analysis as of July 29, 2026 indicates that roblox-login-user.github.io remains active and is being used for credential phishing. The domain resolves to the IP address 185.199.108.153, which is owned by GitHub, Inc., suggesting that the attacker leveraged a legitimate hosting provider to obtain a trusted TLS certificate and reduce suspicion. Nameserver information could not be retrieved (NS_NOT_FOUND), limiting visibility into the domain's DNS delegation.

The domain has been listed on one public security blocklist and is presently blocked by the PhishDestroy service, confirming that at least one defensive platform has identified malicious activity associated with the host. VirusTotal records show that the domain was scanned by 91 security vendors, and none reported a detection at the time of the scan; this absence of detections does not constitute evidence of safety, as the lack of a signature match may reflect limited coverage of the specific phishing kit or rapid content changes. No additional intelligence such as page title, SSL certificate details, or Safe Browsing verdicts is available in the current dataset.

Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the 185.199.108.153 address, and consider adding the host to internal URL filtering rules. Ongoing observation is recommended to detect any changes in hosting, content, or detection status, and to verify whether the domain appears on additional blocklists or gains a detection from future vendor scans.