roblox-com[.]de

The domain roblox-com.de was registered on 2026-03-06 and is currently classified as a high‑risk brand‑impersonation site targeting the Roblox brand. Active monitoring shows the domain resolves to the IPv4 address 151.247.193.142, which is assigned to AS399486 operated by Canada Inc. and geolocated in France.

The authoritative name servers for the zone are ns1.eggywall.cc and ns2.eggywall.cc, both of which are associated with known malicious hosting infrastructure. The site returns an HTTP 301 redirect with the page title “Default Web Site Page” and does not present a TLS certificate, forcing all connections to occur over clear‑text HTTP.

Reputation services assign a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. On VirusTotal, 7 of 95 scanning engines flag the domain as malicious, indicating partial detection coverage. The site is already listed by PhishDestroy as a confirmed phishing host and is tagged with a gaming‑scam profile.

Analysis indicates the primary objective is to lure Roblox users to a counterfeit login page, leveraging the brand name in the domain to increase credibility. However, the limited number of blocklist entries and the modest VirusTotal detection rate suggest that the payload or credential‑harvesting page may be hosted elsewhere or is still under development, leaving some behavioral details unknown.

Defenders should block DNS resolution for roblox-com.de at the network perimeter and enforce HTTPS‑only policies to prevent accidental exposure to the unsecured redirect. Email gateways and web proxies should be configured to flag any URLs containing “roblox‑com.de” or similar variations. Continuous threat‑intel feeds should be consulted for updated indicators, and any observed credential submissions to the domain should be treated as compromised and trigger incident response procedures.