multiroblox[.]icu

On July 24, 2026 analysts observed that the domain multiroblox.icu, created on May 09, 2026, is being used to impersonate the Roblox brand. The site was registered through Fewmoretaps OU d/b/a Trustname.com and is hosted behind Cloudflare infrastructure, as indicated by the authoritative name servers johnny.ns.cloudflare.com and nena.ns.cloudflare.com and the resolved IP address 104.21.62.3, which belongs to AS13335 Cloudflare, Inc. The TLS certificate presented is issued by Let’s Encrypt (E8), and the service enforces HTTP Strict Transport Security, Cloudflare Browser Insights, and HTTP/3, suggesting a modern web stack. VirusTotal scans show that three of ninety-one security vendors flagged the domain, and it appears on a single external blocklist, confirming that at least some security products recognize it as malicious.

The Gridinsoft trust score of 40 out of 100 further reflects a low confidence rating. PhishDestroy has already taken the domain offline, and its current status is listed as offline. While the exact page content, login forms, or visual spoofing techniques have not been captured, the combination of brand targeting, recent registration, low trust score, and partial vendor detections indicates a deliberate credential‑harvesting campaign.

Defenders should block traffic to multiroblox.icu at the network perimeter, add the domain to internal URL filtering lists, and monitor for any outbound connections to the associated Cloudflare IP range. Security teams should also update endpoint detection rules to flag any process that attempts to resolve or contact this domain, and consider informing users of the Roblox community about the impersonation attempt to reduce the risk of credential compromise.