- NordVPN found 196 Roblox phishing addresses active in a single week in July 2026
- Tailor-made scam services sell cloned Roblox pages, disguised links, and even stolen-account checkers
- Some fake logins ask for 2FA codes, backup codes, and PINs to hijack accounts in real time
Roblox scammers no longer need to build their own fake websites, as research from NordVPN's Threat Intelligence team describes an established trade in ready-made Roblox phishing pages.
Buyers get hosting, disguised links, and tools that check whether stolen logins still work, and can pay via untraceable crypto for essentially turnkey solutions to scam children's accounts.
NordVPN counted 196 different Roblox phishing addresses live online over seven days, with some fake login pages asking for more than a password; they also requested the six-digit two-factor authentication code, backup codes, and account PIN.
A scam industry built for beginners and professionals alike
The most striking finding concerns the supply chain, not any single scam. NordVPN found one service openly selling ready-made Roblox phishing pages, backup sites, and disguised links from the same storefront. The one-stop shop for scammers also offered checker tools that test whether stolen account details still work.
That "service" claims to have processed more than six million "logs," underground speak for records of stolen login data, including usernames, passwords, and more. It also displayed a counter showing more than 239,000 registered users on the scam service's website, a significantly high number that suggests how lucrative the market could be.
NordVPN also saw the counter increase by 547 in the 42 hours it tracked, indicating the website has around ~300 new signups a day, even as a rival service grew by 400 during a 4-day tracking period.
It shows how little skill the scam now demands. NordVPN CTO Marijus Briedis said in a statement to TechRadar Pro that these scams "can now be created and deployed by almost anybody."
Enhanced Protection
Many fake sites rely on web addresses that start with the right words. NordVPN found addresses resembling roblox[.]com[.]ug, roblox[.]com[.]py, and roblox[.]com[.]kz, which read as "roblox.com" to anyone skimming the address bar without paying any real attention.
They actually sit on entirely different domains, registered under the country codes for Uganda, Paraguay, and Kazakhstan. NordVPN tested just under 4,000 combinations of Roblox misspellings and country codes and found 123 scam addresses, saying they recorded more than 105,000 page visits. A separate family of at least 521 addresses used names such as "login-roblox" and "roblox-verify" to attempt similar scams.
The pages behind those addresses can be hard to tell from the real thing; NordVPN captured cloned login screens, game pages, and player profiles that copied Roblox's navigation, fonts, and layout. When researchers manually re-checked a random sample, a whopping 22 of 24 addresses were live and visually convincing.
The clones target what children are actually playing: copies included Steal a Brainrot and Grow a Garden, the two games that set Roblox's concurrent-player records in 2025, along with Blox Fruits and PLS DONATE. Others impersonated RoVer, a legitimate verification bot that Discord servers use to link members' Roblox accounts.
Roblox has its own protections in place, including 2FA codes and an "Enhanced Protection" setting that requires a hardware security key or a mobile passkey, but the former isn't enough here, and the latter isn't frictionless, adding complexity to an application that overwhelmingly caters to children.
Many of these scams never begin on Roblox at all. NordVPN traced the lures to Discord servers, YouTube and TikTok links, and direct messages, often promising free Robux. That puts much of the risk beyond Roblox's own recent safety work. The company made facial age checks mandatory for chat worldwide in January 2026, but that does nothing to protect against a random link in a YouTube comment.
Roblox's hacked-account guidance says to remove suspicious downloads and browser extensions, reset the password, and enable two-step verification. If a reset fails, Roblox asks owners to contact it from the account's first email address or the billing email used for the first payment.
Roblox says it "is under no obligation to assist users whose accounts have been compromised" unless the law requires it. You can recover lost items or currency only in very limited circumstances, and you must contact Roblox within 30 days of an account being compromised, which means you need strict account-security rules or a hardware passkey to secure your account.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
