Criticalscore 71 · flagged Saturday, September 5, 2026

ingresseroblox.site

Appeared in the .site zone on Saturday, September 5, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: roblox
+30
brand name at a retail registrar
matched: Name.com, Inc.
+8
brand name and brand-styled page
matched: roblox
+15
form on a brand-styled page
matched: has_form
+18
Registrar
Name.com, Inc.
Nameserver provider
Nameservers
ns1hwy.name.com, ns2fln.name.com, ns3fqs.name.com, ns4jnz.name.com
First-day state
active website
HTTP status
200
Page title
Entrar | Ingresse — Ingressos para eventos do Roblox
Has a form
yes
Brand echoed
roblox

Model opinions

Second opinionlooks like phishingtarget: Ingresse (Brazilian ticketing platform) / Robloxconfidence 90%· claude-opus-5

Newly registered domain combines two brands it does not own (Ingresse + Roblox) and serves a Portuguese-language 'Entrar' page with the Ingresse logo and wordmark, offering 'Ingressos para eventos do Roblox'; the email/password form posts to itself with no offsite links — the classic sealed-room credential-harvest shape.

First passlooks like phishingtarget: Robloxconfidence 95%· claude-haiku-4-5

Domain impersonates Roblox with a login form collecting email and password credentials. The page uses 'Ingresse' branding but explicitly frames itself as 'Ingressos para eventos do Roblox' (tickets for Roblox events), leveraging Roblox's brand to deceive visitors into entering credentials. The password form posts to self with no offsite links—the classic sealed-room phishing pattern—indicating credential harvesting.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, September 5, 2026

Screenshot of ingresseroblox.site taken by the zone census on 2026-09-05

Same data as JSON: /api/zone/domain/ingresseroblox.site. This page is not indexed by search engines and does not link to the site it describes.