titanx4-rbx[.]netlify[.]app

On July 23, 2026, analysis of the domain titanx4-rbx.netlify.app indicates that the site was provisioned through Netlify and first registered on October 2, 2025. The domain resolves to the IPv6 address 2600:1f18:16e:df01::259, which is announced by Amazon.com, Inc. (AS14618) and geolocated to the United States. The TLS certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain issued by DigiCert Inc., confirming that the connection is encrypted but does not imply legitimacy. An HTTP request returns a 404 status code, suggesting that the expected content is missing or the site has been taken down. The page title reported by crawlers is “Get robux,” a phrase commonly associated with attempts to lure users for free virtual currency.

The infrastructure includes Netlify hosting and HTTP Strict Transport Security (HSTS) headers, both typical of legitimate static‑site deployments, which may be leveraged to increase perceived trust. The domain appears on a single security blocklist, identified by PhishDestroy, and VirusTotal records show 16 of 95 scanning engines flagging the domain as malicious, indicating a moderate level of consensus among automated detectors. Nameservers are dns1.p04.nsone.net and dns2.p04.nsone.net. The current operational status is “offline,” meaning the site is no longer serving content at the time of analysis. Because the site is offline, active exploitation cannot be confirmed, and the exact content that was served cannot be verified.

Evidence is limited to the registration details, hosting information, SSL certificate, HTTP response, page title, and the detection counts. No payload samples, screenshots, or phishing kit artifacts have been publicly released, leaving the exact phishing methodology unverified. Defenders should add titanx4-rbx.netlify.app to blocklists, monitor DNS queries for the associated IPv6 address, and consider pre‑emptive filtering in email and web security gateways.