checkrobuxheree[.]blogspot[.]com

This domain, checkrobuxheree.blogspot.com, is flagged as an active airdrop scam targeting users through brand impersonation of Robux reward programs. Analysis indicates the domain is designed to deceive victims into believing they can claim free in-game currency, a common tactic in fraudulent airdrop schemes. The page title, 'Claim Free Robux,' directly reinforces this deception, leveraging the popularity of the target brand to increase engagement. Infrastructure analysis reveals the domain is hosted on Google Blogger, a platform frequently abused for phishing due to its low barrier to entry and trusted SSL certificates. The domain resolves to IP address 142.251.13.132, associated with Google’s infrastructure, and presents a valid SSL certificate issued by Google Trust Services. Despite this apparent legitimacy, the domain has been flagged by 2 of 95 security vendors on VirusTotal, indicating detection by specialized threat intelligence systems. No additional historical data, such as creation date or blocklist counts, is available due to the domain’s registration under a free blogging service, which obfuscates traditional WHOIS records. Current assessment confirms the domain remains active and poses a high risk to users, particularly those unfamiliar with phishing tactics. Recommendations include immediate blocking of the domain at the network level, particularly in environments frequented by younger or less security-aware users. Security teams should update detection rules to include the domain, its resolved IP, and associated SSL certificate thumbprint as indicators of compromise. Users encountering similar scams are advised to verify the legitimacy of reward offers through official channels only and report suspicious domains to relevant threat intelligence platforms for broader mitigation.