How to tell if a Roblox link is fake
A link goes to Roblox only when roblox.com comes right before the first single slash. roblox.com.bz doesn't: the site there is com.bz. In November 2026, 80 scripts Scriptsight ran copied a link like that for the player to open.
How to read a Roblox link
Find the first single slash after https://. Everything before it is the site's address, and the site is named by the end of that address, not the start. Roblox's pages end in roblox.com. If anything comes between roblox.com and that slash, the link goes somewhere else.
Roblox
- https://www.roblox.com/games/…
- https://roblox.com/share?code=…
- https://create.roblox.com/…
- https://en.help.roblox.com/…
Not Roblox
- https://www.roblox.com.bz/games/…
- https://rblx.pk/login
- https://robiox.com.py/users/…
- https://roblox.com.verify-login.xyz/…
Roblox's own help page puts it this way: only enter your login on roblox.com or in the official Roblox apps.
The words before the last part don't count. www, create and en.help are Roblox's own, and anyone can put the word roblox in front of an address they own. A padlock in the address bar doesn't count either: fake sites have one too.
Is roblox.com.bz Roblox?
No. The address ends in com.bz, an ending from Belize that anyone can register a name under, and somebody registered the name roblox there. Roblox has nothing to do with it. It was the fake address caught scripts used most: 64 of the 128 listings that copied a fake Roblox link pointed to it.
The fake addresses scripts used
The 80 scripts were listed 128 times across ScriptBlox and Rscripts, and those listings had been viewed about 885,000 times. Between them they used 16 addresses. Almost all are Roblox's name with a country's ending added after .com.
On RoScripts, 46 listings have been taken down for sending players to a fake Roblox site, among them links to rblx.pk, roblox.com.bz and roblox.com.ms.
What a real Roblox link looks like
| Link to | Address |
|---|---|
| A game | roblox.com/games/142823291/… |
| A private server | roblox.com/share?code=…&type=Server |
| A profile | roblox.com/users/1/profile |
| A group | roblox.com/communities/… |
A fake link copies the part after the slash exactly, so /communities/… or /share?code=… at the end proves nothing. Only the part before the slash tells you where it goes.
How a script sends you to one
The caught scripts didn't open the site themselves. They copied the link to the clipboard and showed a message asking the player to paste it into a browser. The reasons they gave were ordinary ones:
- join a Roblox group to unlock the script
- verify the account before it runs
- get a key from this page
The page that opens looks like a Roblox group or a Roblox sign-in. It asks for a username and password, and whatever is typed there goes to the people who made the page.
A script never needs your Roblox password. You are already signed in when you run it. A script or a page that asks you to sign in again is asking for someone else.
What to do if you signed in on a fake site
Do these on roblox.com itself, typed into the address bar, in this order.
Change your password
Use one you haven't used anywhere else.
Sign out of every other session
Open Settings, then Security, and choose Log Out of All Other Sessions. Someone who signed in with your password stays signed in until you do this.
Turn on 2-Step Verification
With it on, a password alone no longer gets anyone in. Some fake pages ask for the 2-step code as well: Roblox says never to give that code to anyone.
Check the email address on the account
If it was changed to one that isn't yours, change it back.
Contact Roblox Support if you can't sign in
Use the form at roblox.com/support, from the first email address the account had. Roblox says it doesn't guarantee recovery, and only Roblox can give an account back.
If items are already gone, this guide covers what Roblox can and can't restore.
Questions
Is there a fake Roblox link checker?
You don't need one: the address tells you. If roblox.com isn't right before the first single slash, the link isn't Roblox's. Don't use a checker site that asks you to sign in or to paste a cookie.
Why does the fake page look exactly like Roblox?
A page's look can be copied in minutes. The address can't be: only Roblox can put a page on roblox.com. That is why the address is the thing to read.
What if I opened a fake link but didn't sign in?
The pages the caught scripts pointed to ask for a sign-in, and a page you typed nothing into has nothing of yours. Scriptsight doesn't open those pages in a browser, so it can't say what else one might do. Close the page.
Are private server links safe?
A private server link on roblox.com opens Roblox. Fake ones use an address that only looks like it, such as roblox.com.bz, and lead to a sign-in page.