pruebegydo-ship-it[.]github[.]io

This domain, pruebegydo-ship-it.github.io, presents a high-risk phishing threat targeting Roblox users through a fraudulent script library. The site impersonates a legitimate repository of Roblox scripts under the title 'Biblioteca Avanzada de Scripts de Roblox,' aiming to deceive users into downloading malicious payloads or entering credentials. The threat specifically exploits the trust associated with Roblox modding communities, where users frequently seek third-party scripts for game modifications. Analysis indicates the site may distribute malware disguised as scripts or harvest login details through fake authentication prompts. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to IP 185.199.108.153 under AS54113 (Fastly, Inc.). It holds a Let's Encrypt SSL certificate (R12) and is flagged by 2 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Despite its GitHub registration, no legitimate creation date or ownership details are publicly available, further indicating its malicious intent. Users who visited this domain should immediately terminate any active sessions and avoid downloading any files or entering credentials. All passwords associated with Roblox or linked accounts should be changed from a secure device. System scans using updated security tools are recommended to detect potential malware infections. If financial or personal data was submitted, affected users should monitor accounts for unauthorized activity and consider reporting the incident to relevant fraud authorities.