Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that www[.]roblox[.]et/communities/6946372401/Avatar-Designers is a possible phishing page. roblox.et is not Roblox's address (the…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that www[.]roblox[.]et/communities/6946372401/Avatar-Designers is a possible phishing page. roblox.et is not Roblox's address (the real site is roblox.com), and the domain is on the Phishing Army blocklist. Look-alike Roblox community pages are commonly used to steal account logins. Roblox is the brand being spoofed and is not involved.
Look-alike Roblox community pages commonly copy the layout of a group or avatar shop and then ask visitors to sign in. The address roblox.et is not roblox.com, and the path shown by the scanner pointed at a community page. Credentials entered there can be used to take over a Roblox account and any linked payment methods or items.
Roblox is the brand being spoofed and is not involved. The domain is on the Phishing Army blocklist. Sign in to Roblox only through the official app or by typing roblox.com yourself. The flag comes from an automated scanner and has not been independently checked by scammers.com.
Roblox look-alike pages often promise free items, limiteds or a community role in exchange for a login. Offers of that kind are a common way to take over accounts. If you already typed a password on roblox.et, change it at roblox.com from a device you trust, review connected devices and tell anyone who shares the account. Roblox will not ask you to sign in on a .et domain.
Public post on Mastodon, 10 November 2026: https://infosec.exchange/@urldna/117590617608100860
The indicators come from this source and have not been independently checked by scammers.com.
The urlDNA scanning service posted on Mastodon on 12 November 2026 that hxxps://www.roblox.ly/communities/3589766376/FREE-ROBUX-AND-GODLY is a possible phishing page, linking its scan. The domain also appears on the P…
The urlDNA scanning service posted on Mastodon on 11 November 2026 that hxxp://www.roblox.com.am/users/354704663845/profile/ is a possible phishing page, linking its scan. The domain also appears on the Phishing Army…
MalwareTips published an investigation today calling rbxpay.pages.dev a free Robux scam. It says the page, titled "Free Robux – Official Rewards Portal", asks for a Roblox username and an amount of Robux, plays a fake…
PhishDestroy posted on Mastodon on 12 November 2026 three .shop domains it flagged: yervion[.]shop, xorlena[.]shop and xireka[.]shop. Its records show all three were registered on 1 July 2026 and use the same storefro…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…