The latest OTX pulse exposes a sprawling credential harvesting and fraud ecosystem specifically targeting children through popular gaming platforms like Roblox and Minecraft. This campaign relies heavily on typosquatting and deceptive "offerwall" schemes. Victims are lured by promises of free in-game currency (e.g., Robux) and directed to malicious infrastructure such as roblox-com.com and blox.ink.

The attack chain is socially engineered: users land on these phishing portals via deceptive links, where they are prompted to enter credentials or perform tasks that harvest personal data (PII) and enroll them in subscription traps. The objective is twofold: credential theft for account takeover and financial fraud via unauthorized subscription sign-ups.

Threat Actor / Malware Profile

Adversary: Unknown (Financially motivated Cybercriminals)

Distribution Method:

SEO Poisoning / Social Engineering: Links spread via social media, gaming forums, and YouTube videos promising free hacks or currency.
Typosquatting: Registration of domains visually similar to legitimate platforms (e.g., roblox-com.com vs roblox.com).

Payload Behavior:

Credential Harvesting: HTML forms designed to mimic official login pages to capture usernames and passwords.
Data Harvesting: Collection of PII under the guise of age verification or "reward" eligibility.
Subscription Fraud: Scripting to initiate hidden subscription flows on connected devices.

Persistence/Infrastructure:

The campaign utilizes disposable domains and infrastructure hosted on various ISPs to evade takedowns.
No traditional malware binary is required; the attack relies entirely on web-based deception and browser input.

IOC Analysis

Indicator Types:

Domains (8): The primary IOCs are domains used for phishing pages and redirection services.
Hostnames (1): Specific host configuration for C2/Phishing landing pages.

Operational Guidance:

DNS Blocking: Immediate implementation of these domains into internal blocklists (RPZ) and secure web gateways (SWG).
Proxy Logs: SOC teams should query proxy/DNS logs for any successful resolutions to these specific indicators to identify infected or phished users within the network.
Tooling: Splunk, Elastic, or Microsoft Sentinel can ingest these IOCs via threat intelligence feeds (STIX/TAXII).

Detection Engineering

YAML

title: Suspicious DNS Query - Gaming Phishing Infrastructure
id: 8f3d4a2b-1c9e-4a5f-9b6c-3d2e1f0a9b8c
description: Detects DNS queries to known typosquatted domains associated with Roblox and Minecraft credential harvesting campaigns.
status: stable
author: Security Arsenal
date: 2026/08/02
references:
  - https://otx.alienvault.com/pulse/61000000/
tags:
  - attack.credential_access
  - attack.initial_access
  - attack.t1566.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    query|contains:
      - 'roblox-com.com'
      - 'blox.ink'
      - 'bloxlink.net'
      - 'bloxlink.site'
      - 'www-roblox.pw'
      - 'robiox.com.ua'
      - 'robiox.com.ps'
  condition: selection
falsepositives:
  - Unknown
level: high
---
title: Potential Gaming Credential Phishing via Network Traffic
id: 7e2c3d1a-0b8d-3a4e-8a5b-2c1d0e9f8a7c
description: Identifies outbound network connections to suspicious gaming-related domains not owned by official vendors.
status: stable
author: Security Arsenal
date: 2026/08/02
references:
  - https://otx.alienvault.com/pulse/61000000/
tags:
  - attack.exfiltration
  - attack.command_and_control
logsource:
  category: network_connection
detection:
  selection:
    destination.hostname|contains:
      - 'roblox-com.com'
      - 'blox.ink'
      - 'bloxlink.net'
      - 'bloxlink.site'
      - 'www-roblox.pw'
      - 'robiox.com.ua'
      - 'robiox.com.ps'
  condition: selection
falsepositives:
  - Legitimate gaming traffic (unlikely given TLDs)
level: critical
---
title: Browser Process Connecting to Known Phishing Domains
id: 6d1b2c0a-9a7c-2a3d-7a4a-1b0c9d8e7f6a
description: Detects browser processes (Chrome, Firefox, Edge) initiating connections to known Roblox/Minecraft phishing indicators.
status: stable
author: Security Arsenal
date: 2026/08/02
references:
  - https://otx.alienvault.com/pulse/61000000/
tags:
  - attack.initial_access
logsource:
  category: network_connection
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\opera.exe'
  selection_dst:
    destination.hostname|contains:
      - 'roblox-com.com'
      - 'blox.ink'
      - 'bloxlink.net'
      - 'bloxlink.site'
      - 'www-roblox.pw'
      - 'robiox.com.ua'
      - 'robiox.com.ps'
  condition: all of selection_*
falsepositives:
  - Low
level: high


kql
// Hunt for DNS queries or Network Connections to known gaming phishing indicators
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" or ActionType == "DnsQuerySuccess"
| where RemoteUrl has_any ("roblox-com.com", "blox.ink", "bloxlink.net", "bloxlink.site", "www-roblox.pw", "robiox.com.ua", "robiox.com.ps") 
   or DNSRequestName has_any ("roblox-com.com", "blox.ink", "bloxlink.net", "bloxlink.site", "www-roblox.pw", "robiox.com.ua", "robiox.com.ps")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| order by Timestamp desc


powershell
# IOC Hunt Script: Gaming Phishing Domains
# Run on a gateway or analyze DNS logs via API if possible.
# This script checks if the local machine can resolve the malicious domains.

$MaliciousDomains = @(
    "roblox-com.com",
    "blox.ink",
    "bloxlink.net",
    "bloxlink.site",
    "www-roblox.pw",
    "robiox.com.ua",
    "robiox.com.ps"
)

Write-Host "[+] Starting DNS Resolution Check for Gaming Phishing IOCs..." -ForegroundColor Cyan

foreach ($domain in $MaliciousDomains) {
    try {
        $result = Resolve-DnsName -Name $domain -ErrorAction Stop -QuickTimeout | Select-Object -First 1
        if ($result) {
            Write-Host "[THREAT DETECTED] Resolved: $domain" -ForegroundColor Red
            Write-Host "    -> IP Address: $($result.IPAddress)" -ForegroundColor DarkRed
        }
    }
    catch {
        Write-Host "[SAFE] Unresolved/Blocked: $domain" -ForegroundColor Green
    }
}


# Response Priorities

*   **Immediate:**
    *   Block all listed domains at the DNS resolver and Firewall level.
    *   Query proxy logs for any historical successful connections to these IOCs to identify potential victims within the organization.

*   **24 Hours:**
    *   If successful connections are found, initiate identity verification for the associated users. While this campaign targets personal gaming credentials, users often recycle passwords, posing a risk to corporate SSO accounts.
    *   Reset passwords for any user who has successfully authenticated to these domains via a managed device.

*   **1 Week:**
    *   **Architecture Hardening:** Review DNS filtering policies to include broader protections against typosquatting and "free" gaming offer categories.
    *   **User Awareness:** Distribute specific security awareness bulletins to staff (specifically those with school-aged children) highlighting the risks of "free currency" scams and offerwalls.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Gaming Platform Credential Harvesting: Roblox/Minecraft Phishing Ecosystem — OTX Pulse Analysis

Threat Actor / Malware Profile

IOC Analysis

Detection Engineering

Related Resources

Is your security operations ready?