wvww-robloxx[.]iconce[.]com

Analysis of wvww-robloxx.iconce.com shows an active generic phishing infrastructure that has been operating since its registration on 11 January 2024 through NameSilo, LLC. The domain is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating use of Vercel’s DNS service. DNS resolution points to the IPv4 address 64.29.17.65, which is the sole hosting endpoint observed. The site is listed on a security blocklist and has been flagged by PhishDestroy, confirming its malicious intent.

VirusTotal scans return four positives out of ninety‑one antivirus and URL engines, reinforcing the suspicion despite the relatively low detection count. No additional intelligence such as SSL certificates, HTTP status codes, Safe Browsing verdicts, OTX tags, or page‑title metadata is currently available, leaving the exact landing‑page behavior unverified. The lack of publicly disclosed content means defenders cannot rely on visual indicators, but the convergence of registrar data, DNS configuration, IP concentration, and multiple independent detections provides sufficient confidence to treat the domain as a high‑risk phishing source.

Recommended mitigation steps include immediate blocking of the domain and its associated IP at perimeter firewalls, proxy filters, and endpoint protection suites; updating web‑gateway URL blocklists with the observed indicator; and monitoring for any new sub‑domains or DNS changes that could be leveraged for further campaigns. Continuous re‑scanning with VirusTotal and other sandboxes is advised to capture potential evolution of the payload.