Phishunt flags Roblox login phishing on lookalike domain https--www--roblox.com
Phishunt.io flagged a Roblox-branded login page on the lookalike domain https--www--roblox.com, built to steal Roblox usernames and passwords.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Phishing tracker phishunt.io posted on October 15, 2026 that it detected a Roblox phishing page at https--www--roblox[.]com/login?returnUrl=1717572407. Phishunt lists the site as resolving to 172.67.213.87 behind Cloudflare (AS13335), registered through Dynadot. Its screenshot shows a Roblox-branded login with username and password fields.
The domain imitates a Roblox web address by spelling out 'https--www--' in the hostname; it is not an official Roblox domain. Roblox is being impersonated and is not involved.
How the scam works
Phishunt's Roblox feed says such pages target Roblox account credentials and in-game currency. The game is popular with younger players, so links are often shared as offers of free Robux or items. A hostname that starts with 'https--www--roblox' can look like the real address at a glance, especially on a phone.
Note: the phishunt post is an automated detection and does not say how the link was spread; this section describes the general pattern.
Source
phishunt.io on X (@phishunt_io), post of October 15, 2026, and phishunt's Roblox phishing feed.
Red flags
- A Roblox login page whose address is anything other than roblox.com.
- Offers of free Robux or items that require logging in.
- Hostnames that spell out 'https' or 'www' inside the domain name.
If you were targeted
- 1Only sign in to Roblox at roblox.com or in the official app.
- 2If you entered your details, change your Roblox password, turn on two-step verification and check your account's linked email.
- 3Parents: talk with children about 'free Robux' links.