robloxpays[.]com

PhishDestroy identifies robloxpays.com as an active cryptocurrency drainer site operating under a Sav.com, LLC registration. The domain was created on March 25, 2026, and currently resolves to IP address 91.218.49.176. This infrastructure hosts a fake payment portal designed to steal cryptocurrency from unsuspecting users by mimicking legitimate Roblox financial services.

This domain was flagged by Google Safe Browsing as a social engineering threat and has been detected by 6 out of 95 security vendors on VirusTotal. It uses a valid Let's Encrypt SSL certificate to appear legitimate. The short domain age combined with the immediate malicious deployment suggests an opportunistic attack leveraging brand impersonation rather than a long-term campaign. The low VT detection ratio indicates limited but targeted distribution likely through social media phishing posts and gaming forums.

As of current analysis, robloxpays.com remains active with elevated risk status. Immediate user action includes avoidance of the domain and verification through PhishDestroy's threat intelligence platform using seed identifier 6505b4. While domain takedown procedures may be initiated, the risk remains active until formal deactivation occurs. Users should treat any robloxpays.com payment links as malicious and report such activity immediately to prevent further victimization.