The fake pages are sold ready-made, and two-factor authentication doesn’t stop them.
NordVPN’s Threat Intelligence research team has found a working industry selling ready-made tools for stealing children’s Roblox accounts. A scammer no longer needs to build a fake website or know how phishing works. They sign up to a service with a Discord account, click a button, and get a pixel-perfect copy of a Roblox login page, the hosting, the web address, and a tool that collects every password typed into it.
Researchers identified 196 different fake Roblox sites active in a single seven-day window. The victims are mostly young children. In complaints filed with the US Federal Trade Commission about Roblox, 61% involve children aged 8 to 12, and another 18% involve children aged 4 to 7.
“These pages copy the game your child was playing five minutes ago, right down to the play count,” says Marijus Briedis, chief technology officer at NordVPN. “There’s often nothing visually wrong with them. And the link usually comes from a friend, because that friend got beamed an hour earlier and their account is now sending it to everyone they know.”
The fake pages are almost impossible to spot
NordVPN researchers captured fake login pages, cloned game pages and cloned player profiles reproducing Roblox’s navigation, fonts and layouts. Some copy the games children are playing right now, including Steal a Brainrot, Grow a Garden, Blox Fruits and PLS DONATE. Others impersonate RoVer, a legitimate verification service used to link Roblox and Discord accounts.
The most common fakes sit on addresses like roblox[.]com[.]ug, roblox[.]com[.]py and roblox[.]com[.]kz. Read quickly, each one appears to contain roblox.com. Another version swaps letters that look identical on screen, like robiox[.]com[.]ps, which uses a lower-case i instead of an l.
NordVPN tested just under 4,000 combinations of Roblox misspellings and country codes and found 123 live scam addresses with more than 105,000 recorded visits between them. A separate group of at least 521 addresses puts the brand name next to a word instead, in forms like login-roblox and roblox-verify.
Researchers also found fraudulent sites displaying a valid HTTPS padlock, showing why checking for the familiar security symbol alone is no guarantee that a website is genuine.
NordVPN read the code behind live fake login pages, and they don’t stop at the password. They ask for the six-digit two-factor code, then the nine-digit backup code, then the account PIN. The scammer is watching in real time and types the code into the real Roblox before it expires.
The code was genuine, and the child really did approve the login. Nothing was hacked. The page then forwards the child to the real Roblox site, so the login appears to have worked, and most families find out weeks later once the Robux is spent and the rare items have been traded away.
How to stay safe
Marijus Briedis advises parents:
-
Make sure your child only logs in through the official app, or by typing roblox.com themselves. Never through a link, and especially not one sent by a friend, because that friend’s account may already be stolen.
-
Tell them free Robux does not exist. Robux is created only by Roblox. Every site offering to generate it is lying, so there is nothing to think over.
-
Explain that two-factor codes are passwords. Keep 2FA switched on, but your child needs to know that no six-digit code, backup code or PIN should ever be typed anywhere except the real Roblox.
-
Agree a rule about mods and “game enhancers”. Script executors, FPS boosters and mod menus downloaded from links are malware, and they usually take every password saved in the browser, including yours on a shared computer.
-
Look at what sits next to the game, not the game. Most of these scams start on a Discord server, a YouTube description or a TikTok comment, so that is where the conversation needs to happen.
Methodology
NordVPN’s Threat Intelligence team investigated active scam infrastructure targeting Roblox users during July 2026. Researchers tested just under 4,000 combinations built from eight Roblox spelling variants and country-code domains, identifying 123 scam addresses, and separately observed a family of at least 521 addresses using terms such as “login-roblox” and “roblox-verify”.
A broader measurement found 196 different Roblox phishing addresses active in the seven days to 29 July 2026. These counts cover overlapping groups and should not be added together. Analysts manually re-checked a random sample, confirming 22 of 24 addresses as live, convincing Roblox imitations, and examined the source code of live phishing pages including those requesting two-factor and backup codes.
ABOUT NORDVPN
NordVPN is an all-in-one digital privacy and security app trusted by millions of internet users worldwide. The NordVPN app combines the world’s most advanced VPN, a next-generation antivirus, and other built-in security features, such as Dark Web Monitor™, designed to help users stay safer and more private online. NordVPN helps protect against phishing, scams, malicious websites, trackers, intrusive ads, and malware, while strengthening online privacy. For more information, visit nordvpn.com.
