robloxfunds[.]com

Robloxfunds.com was registered on 21 February 2026 via the registrar Sav.com, LLC. The domain resolves to the IPv4 address 91.218.49.176, which is announced by Autonomous System AS6698 operated by Virtual Systems LLC and geolocated to Ukraine. The authoritative nameservers listed for the zone are jill.theonionhost.com and ray.theonionhost.com, both belonging to the same hosting provider. No TLS certificate is presented; HTTP connections are served without encryption. The site’s HTML title reads “Redeem Robux”, indicating an attempt to lure users seeking virtual currency for the Roblox platform. The campaign is classified as a Gaming Scam and explicitly impersonates the “robux” brand.

Threat‑intelligence feeds have recorded the domain on a single security blocklist, and the anti‑phishing service PhishDestroy has actively blocked it. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain as malicious, reflecting a moderate consensus of malicious intent. Gridinsoft assigns a trust score of 1 out of 100, further corroborating the low reputation. The domain is currently offline, and no SSL certificate is observed, which may be a result of takedown actions. While the available data confirms the infrastructure and malicious intent, the exact phishing page content, credential collection mechanisms, and any associated command‑and‑control infrastructure remain unknown because the site is no longer reachable.

Defenders should update URL filtering and DNS blocklists to include robloxfunds.com and its associated IP address 91.218.49.176. Monitoring of the registrar Sav.com, LLC for similar registrations and of the hosting provider’s name servers for new domains exhibiting comparable patterns is advised. Additionally, security appliances that incorporate VirusTotal or similar multi‑engine verdicts should be configured to treat the 16 positive detections as indicative of malicious activity.