roblox[.]com[.]gy

The domain roblox.com.gy was observed resolving to the IP address 128.116.102.3, an address located in the United States and announced by ASN AS22697, which is registered to Roblox. This alignment of the IP with the legitimate Roblox network is atypical for a brand‑impersonating site and suggests an attempt to lend credibility to the malicious host. The domain’s authoritative nameservers are ns1.eggywall.cc and ns2.eggywall.cc, which are unrelated to Roblox’s official DNS infrastructure, indicating a distinct hosting environment. The site employed Amazon Web Services components, including Amazon S3 storage, and was delivered over HTTP/3 with HSTS enforcement, while the front‑end framework was identified as AngularJS. The TLS certificate was issued by Let’s Encrypt (E7), a free certificate authority commonly used by both benign and malicious operators.

The page title returned by the server was simply "Roblox," matching the targeted brand and reinforcing the impersonation narrative. Security telemetry shows the domain appearing on a single blocklist and being actively blocked by PhishDestroy. AlienVault OTX recorded the domain in two separate threat‑intel pulses, providing external corroboration of malicious activity. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in its malicious nature. VirusTotal scans reported 15 detections out of 95 scanned vendors, confirming that multiple security products have flagged the domain as hostile.

The registrar listed for the domain is GYNIC Direct, a registrar that does not appear to be associated with Roblox’s official registration channels. The overall risk assessment was elevated, and the domain’s status is currently offline, indicating that the malicious operation has been taken down or is no longer serving content.