roblox[.]cd

This domain, roblox.cd, is actively being used for brand impersonation of Roblox. The site is protected by a Let's Encrypt certificate (E7) and serves content over HTTPS with HSTS enabled. Infrastructure analysis shows it resolves to 91.240.21.7, an IP registered to Hooray Solutions Corp. in Germany and hosted on Ubuntu with Apache HTTP Server, employing AngularJS and Google Analytics. The domain was registered on 27 April 2026 via SCPT and uses the nameservers ns1.eggywall.cc and ns2.eggywall.st. Threat intelligence indicates the site is classified as credential phishing; the page title returned by the server is “Verifying Browser | EggyWall”, and the HTTP response code is 403. The domain appears on the PhishDestroy and PhishingDB blocklists, is flagged by Google Safe Browsing for social engineering, and has been cited in 50 AlienVault OTX pulses. VirusTotal reports 21 of 91 security vendors flag the host as malicious, and Gridinsoft assigns a trust score of 0 / 100. Although the exact content beyond the title has not been captured, the combination of brand impersonation, credential‑phishing labeling, and multiple detections confirms a high‑risk profile. Defenders should block the domain at network perimeter, add it to internal blocklists, monitor for any DNS or TLS traffic to the IP, and educate users that any unsolicited Roblox credential requests are likely fraudulent.