rbxlabs[.]vercel[.]app

This domain, rbxlabs.vercel.app, is flagged as a generic phishing site targeting users of the Roblox gaming platform. The page title, 'RBXLabs - Free Game copier,' suggests an attempt to deceive users into believing they can copy or duplicate Roblox games without authorization, a common lure in credential harvesting and malware distribution campaigns. No specific drainer kit has been conclusively identified at this stage, but the infrastructure aligns with known phishing patterns targeting gaming communities. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.195, associated with Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common certificate authority for both legitimate and malicious domains. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, indicating the domain has not yet been widely flagged. The domain is registered through Vercel Inc., a platform frequently abused for hosting phishing pages due to its free tier and ease of deployment. It appears on one security blocklist, and the page remains accessible despite partial mitigation efforts. Current status indicates the domain is still active, posing an ongoing risk to users who may be lured by the promise of free game copying tools. While one security vendor has blocked access, the lack of broader detection suggests the campaign may still be in an early or evasive phase. Users are advised to avoid interacting with the domain, and network administrators should consider blocking the IP and domain at the perimeter. Further monitoring is required to determine if additional infrastructure or payloads are associated with this campaign.