rbxrewards[.]roblox-635[.]workers[.]dev

PhishDestroy identifies rbxrewards.roblox-635.workers.dev as an active fake Roblox login phishing domain designed to harvest user credentials and session tokens. The domain mimics official Roblox reward pages to trick victims into entering their login details, which are then exfiltrated to attacker-controlled servers. The page leverages Cloudflare Workers to host the phishing content under a workers.dev subdomain, a tactic commonly used to evade traditional domain-based blocklists. This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category, confirming its malicious intent. VirusTotal currently shows 20/95 security engines detecting the threat, highlighting how new or evasive phishing pages can fly under the radar initially. The domain was registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3. Let's Encrypt provides the SSL certificate, which does not indicate legitimacy as phishing domains frequently obtain valid certificates to appear trustworthy. Users who visited this domain should immediately change their Roblox password and enable two-factor authentication. Check all connected devices for unauthorized logins and revoke any unfamiliar sessions. Scan your system with updated antivirus software and review financial accounts for suspicious transactions. Report the domain to PhishDestroy to help protect others from this credential harvesting campaign.