keysistacks[.]live

PhishDestroy identifies keysistacks.live as an active Robux-themed phishing domain designed to trick users into surrendering their Roblox currency credentials. The landing page deliberately mimics an 'Add Robux' service, leveraging the promise of free in-game currency to harvest login details and payment information. Once harvested, stolen credentials are monetized through resale markets or used to drain connected accounts, while payment data is either sold or leveraged for fraudulent purchases. This campaign preys on the trust of Roblox players, particularly younger users who may be less security-aware, making it a high-impact threat to both individuals and the broader Roblox ecosystem.

This domain was flagged by PhishDestroy with zero detections on VirusTotal out of 95 scanners, indicating it remains undetected by many security tools. Registered on March 27, 2026 through Dynadot Inc., the domain uses a Let’s Encrypt SSL certificate to appear legitimate and resolves to IP 91.218.49.169, a known hosting provider with a history of abuse. Despite its recent creation, it has already been associated with active phishing campaigns targeting Roblox users.

If you visited keysistacks.live or entered any information, immediately change your Roblox password and enable two-factor authentication. Scan your device for malware using a reputable antivirus tool and monitor your accounts for unauthorized transactions. Report the domain to your security team or via platforms like PhishDestroy to help block future access. Do not interact further with this domain and warn others in your community to prevent further victimization.