robloxf[.]com[.]es

The domain robloxf.com.es is actively hosting a brand‑impersonation campaign that targets the Roblox gaming platform. The site returns HTTP 200 and presents the page title “robloxf.com.es”, matching the domain name. No TLS certificate is configured, indicating that the service is delivered over plain HTTP only. DNS resolution points to the IPv4 address 185.53.177.20, which belongs to Team Internet AG (AS61969) in Germany. The domain is delegated to four EuroDNS name servers (ns1‑ns4.eurodns.com).

Security telemetry shows the domain has been placed on at least one public blocklist and was flagged by PhishDestroy. In the AlienVault Open Threat Exchange, the domain appears in sixteen distinct threat‑intel pulses, reinforcing its malicious reputation. VirusTotal scans identified nineteen of ninety‑five security vendors as flagging the domain, confirming detection by multiple anti‑malware engines. The campaign is classified as a “Gaming Scam” and explicitly impersonates Roblox, as indicated by the brand target field.

Current status remains active as of the report date (23 July 2026). While the page content has not been publicly disclosed, the combination of blocklist presence, multiple OTX references, and vendor detections provides strong evidence of malicious intent. Defensive teams should consider immediate DNS or proxy blocking of robloxf.com.es and its underlying IP address, monitor for any related sub‑domains, and enforce TLS inspection to capture any future credential‑phishing attempts that might migrate to encrypted channels. Ongoing observation of the hosting ASN and associated traffic patterns is advised to detect potential expansion of the infrastructure.