robiox[.]com[.]ua

Analysis of robiox.com.ua indicates a high-risk domain actively impersonating the Roblox brand, as evidenced by multiple threat intelligence sources and infrastructure characteristics. The domain was registered on July 31, 2025, through INWX GmbH, with nameservers raphaela.ns.cloudflare.com and rory.ns.cloudflare.com, suggesting Cloudflare protection. It resolves to IP address 128.116.44.3, geolocated in Germany under AS22697, which is associated with Roblox infrastructure, raising concerns about potential abuse of legitimate hosting pathways. The HTTP status returns a 302 redirect, a common tactic to obscure final landing pages or distribute malicious payloads. The page title explicitly displays 'Roblox,' aligning with the reported scam type of a gaming scam, though the exact content and mechanics of the fraudulent activity remain unconfirmed due to the redirect behavior.

Detection metrics reinforce the domain's malicious classification. Gridinsoft assigns a trust score of 1 out of 100, and AlienVault OTX lists the domain in 17 threat intelligence pulses, indicating widespread recognition of its suspicious nature. Sixteen of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on at least one security blocklist, including PhishDestroy. The SSL certificate is issued by Let's Encrypt (E7), a common choice for both legitimate and fraudulent sites, providing no inherent indication of trustworthiness. Detected technologies include Amazon Web Services, AngularJS, HSTS, Amazon S3, and HTTP/3, which are consistent with modern web infrastructure but offer no definitive proof of intent.

Defenders should treat this domain as active and high-risk. Block access at the network level, particularly in environments frequented by younger users or gaming communities. Monitor for references to robiox.com.ua in logs, emails, or social engineering attempts, as the domain may be leveraged in phishing campaigns or credential harvesting.