roblox[.]com[.]kz

This domain, roblox.com.kz, is flagged as a high-risk brand impersonation threat targeting the Roblox gaming platform. Registered on November 25, 2025, through ICPS, it remains active as of July 12, 2026. The domain resolves to IP address 172.67.193.120, hosted in the United States on AS13395 (Cloudflare, Inc.), and uses Cloudflare nameservers. Security analysis reveals broad consensus of malicious activity: VirusTotal reports 20 out of 95 security vendors flagging the domain, and it appears on three security blocklists including PhishDestroy, DiscordPhishing, and PhishingDB. AlienVault OTX includes this domain in 27 threat intelligence pulses, and Gridinsoft assigns a trust score of only 1 out of 100. The SSL certificate is issued by Google Trust Services (WE1), and the page title observed is 'Site Maintenance', which may serve as a placeholder or decoy while the actual phishing content is served conditionally. Technologies detected include Google Analytics, Cloudflare Browser Insights, Cloudflare, and HTTP/3, indicating use of modern infrastructure that could complicate takedown efforts. The HTTP status code 200 confirms the domain is live and serving content. The exact nature of the phishing page has not been directly observed, but the brand target is explicitly Roblox, suggesting the site likely attempts to collect login credentials or personal information from users seeking Roblox services. Uncertainties remain regarding the specific phishing kit in use and whether the page adapts content based on user agent or geographic location. Defenders should block the domain at the network level, add the IP to threat intelligence feeds, and monitor for related subdomains or variations. Users should be warned not to visit the domain or enter any credentials. Takedown requests should be directed to the registrar and hosting provider. Continuous monitoring is advised as the domain may pivot to new IPs or alter its page content to evade detection.