redeembux[.]com

The domain redeembux.com is currently classified as a high‑risk generic phishing site that targets users seeking to redeem virtual currency. The site returns HTTP 200 and presents the page title “Redeem Robux”, matching the advertised lure. Its activity is confirmed by a block by PhishDestroy and its presence on a security blocklist. Infrastructure analysis shows the domain was created on 06 Mar 2026 and registered through Sav.com, LLC. DNS resolution points to IP address 91.218.49.176, which belongs to AS6698 Virtual Systems LLC and is geolocated to Ukraine. Authoritative nameservers are jill.theonionhost.com and ray.theonionhost.com, and the domain publishes an MX record with priority 0 that points to redeembux.com itself. The site uses a Let’s Encrypt certificate (R12) and runs on LiteSpeed with Tailwind CSS and HTTP/3 enabled. Reputation metrics reinforce the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports five of ninety‑five scanned security vendors flagging the domain. The domain is listed on one known blocklist, and its risk level is marked as high while its operational status remains active. Open questions remain regarding the threat actor’s full infrastructure and any additional payloads that may be delivered after initial page load. No public malware samples have been linked to the domain, and the limited number of blocklist entries suggests that detection coverage may be incomplete. Continuous observation is required to capture any evolution of the site or associated infrastructure. Defenders should block redeembux.com at network perimeters and endpoint filters, enforce TLS inspection to capture the underlying HTTP traffic, and educate users that any unsolicited request to “redeem” virtual currency is likely fraudulent. Monitoring of the associated IP address and nameservers for new activity is also advised.