info-roblox[.]com

The domain info-roblox.com was registered on April 16, 2025 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 91.231.222.76, which is allocated to Netiface LLC (AS36680) in the Republic of Slovenia. Both authoritative name servers, ns1.eggywall.cc and ns2.eggywall.cc, are hosted on the same network, indicating a single‑operator hosting environment. No TLS certificate is presented for the site, meaning any traffic would be conducted over unencrypted HTTP, a common characteristic of low‑trust malicious infrastructure.

The page title observed during a brief crawl was "Catalog - Roblox", directly referencing the targeted brand and confirming the domain’s intent to impersonate Roblox’s catalog service. VirusTotal scans recorded ten detections out of ninety‑five security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. AlienVault OTX lists the domain in three separate threat pulses, and it appears on one external security blocklist, further corroborating its reputation as a gaming‑related scam. PhishDestroy has also flagged the domain, indicating active mitigation by anti‑phishing services.

The available evidence points to a brand‑impersonation campaign targeting Roblox users, likely to harvest credentials or drive traffic to fraudulent offers. Uncertainties remain regarding the exact payload delivered to victims, the extent of victim interaction, and whether additional infrastructure components (such as command‑and‑control servers or drop sites) are linked to the same IP range. Defenders should block the domain and its associated IP at network perimeters, add the observed name servers to deny‑list configurations, and monitor DNS queries for related aliases. Continuous re‑scanning of the IP and any newly resolved hostnames is advised, as the infrastructure may be repurposed for future campaigns.