Highscore 46 · flagged Thursday, November 12, 2026

rbxtoolls.sbs

Appeared in the .sbs zone on Thursday, November 12, 2026; by the end of that day the census found active website about saas & tech. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: sbs
+8
brand in page title, not in the name
matched: roblox
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Hosting Concepts B.V. d/b/a Registrar.eu
Nameserver provider
Nameservers
elaine.ns.cloudflare.com, henry.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
RBX Tools — Roblox Automation Suite
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks like phishingtarget: Robloxconfidence 80%· claude-opus-5-5

The newly registered .sbs 'RBX Tools' page offers classic Roblox account-beaming lures (game copier, follow bot, voice chat unlocker, game joiner). It has a password form posting to itself with no offsite links, the typical shape of a Roblox credential or cookie stealer.

First passlooks like phishingtarget: Robloxconfidence 95%· claude-haiku-4-5

The domain rbxtoolls.sbs (a typosquat of 'rblx') presents itself as 'The #1 Roblox Tools Service' with page title claiming 'RBX Tools — Roblox Automation Suite', impersonating Roblox branding and product positioning. The presence of a password form posting to itself with no offsite links, combined with offers of automation tools (game copiers, bot followers, visit botters) that violate Roblox Terms of Service, indicates a sealed-room credential-capture phish designed to harvest Roblox account cr

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, November 12, 2026

Screenshot of rbxtoolls.sbs taken by the zone census on 2026-11-12

Same data as JSON: /api/zone/domain/rbxtoolls.sbs. This page is not indexed by search engines and does not link to the site it describes.