robloxy[.]cam

robloxy.cam was registered through Dynadot on 17 December 2025. The domain resolves to 104.21.34.219, an address owned by Cloudflare (AS13335) located in the United States. Nameserver records point to asa.ns.cloudflare.com and kurt.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. No TLS certificate is presented for the site, indicating that HTTPS is not configured. The HTTP response title returned was “Site Maintenance”, which does not reveal any overt malicious content but aligns with a common tactic of temporarily hiding phishing pages.

The domain is classified as a Roblox brand impersonation and associated with a gaming‑related scam. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has listed the domain as blocked, and AlienVault OTX references it in one threat‑intel pulse. VirusTotal reports that 12 of 93 scanning engines flagged the domain, providing additional confirmation of malicious intent.

The current host status is offline, suggesting the payload may have been taken down or moved, but the infrastructure artifacts remain observable. Defenders should continue to block the domain and its hosting IP at perimeter filters, add the associated nameservers to DNS‑sinkhole policies, and monitor for any re‑registration or similar domains that reuse the same registrar or Cloudflare infrastructure. Ongoing correlation with detection logs for Roblox‑related credential theft attempts is recommended, as the threat actor may employ alternative domains to lure victims. Because the site content has not been publicly captured, further investigation is needed to determine the exact phishing workflow, but the existing technical indicators warrant inclusion in elevated‑risk watchlists.