If you’ve recently come across a suspicious-looking site named 36k.my, you might want to stop right there – it’s part of a wider Robux scam network that endlessly rebrands itself. I’ve tracked these clone sites for a while, and 36k.my fits the pattern perfectly: once one domain gets exposed, the scammers spawn another under a new name but with the same fake “free Robux” generator layout. They mimic official Roblox pages, complete with logos, color schemes, and trust badges that mean absolutely nothing. The real trick isn’t the fake offer – it’s the data harvesting. By logging in or “verifying” your account, you’re handing them your credentials and possibly downloading malware in the background. These sites like 36k.my, 53k.my, 74t.my or Der.bio don’t give Robux; they take privacy, time, and occasionally your whole account. It’s a well-worn scam cycle that survives because curiosity still beats caution. Don’t feed it.
Scams of 36k.my‘s type are known to steal personal data and passwords. Install SpyHunter Pro to scan for risks, remove any dangerous trackers, and enable real-time protection.
Try Free For 7 Days*
Buy now15% OFF if you buy straight without trial.
OFFERWhat exactly is the 36k.my grift?
This section sets the baseline: 36k.my presents itself as a path to free Robux, then converts that promise into tasks that pay the site rather than the player. From the moment a player arrives, the site poses as a companion to a platform you already trust. The page borrows familiar colors and icons, and the copy hints at an “official” relationship without stating it. A simple prompt for your Roblox username creates a sense of account linkage. The trick works because it avoids the scariest asks. No “password.” No “payment.” The absence of those words makes the page feel less risky even while it builds false credibility.
After you select a large Robux amount, often far beyond any realistic bonus, 36k.my routes you to “human verification.” That step is not security. It is a paywall dressed up as a check. The tasks include surveys that collect emails or phone numbers. Some prompt app installs that trigger affiliate bounties. Others push trial subscriptions that later bill you if you forget to cancel. Many clicks travel through ad networks that monetize each redirect. The “verification” path is tuned to loop or contradict itself. You never quite qualify for the reward because the system is not built to pay you.
The site also leans on pressure and mimicry. Fake countdowns and “limited stock” banners push quick decisions. Progress bars nudge you forward even when nothing meaningful has happened. Logos, names, and UI patterns borrow Roblox’s trust and blend away risk signals. A small ask leads to larger asks. “Just enter your username” becomes “install two apps” or “share this with friends.” Oversized reward numbers pull attention to the headline promise and away from the mechanical details that matter.
Step back and the reality is clear. 36k.my does not and cannot deposit Robux into your account. Third-party sites have no method to credit your Roblox balance. The site earns money only when you complete “verification” tasks or leak data or access. When a campaign stops working, the operators close the domain and relaunch under a fresh name. The template stays. The label changes. The cycle repeats.
If 36k.my caught you: immediate moves
This section focuses on containment first so new damage stops now. You secure accounts, revoke risky access, and clean devices. Refunds and disputes come afterward. Money lost to shady trials or gift cards may be hard to recover, and “recovery services” often lead to a second fraud. Stabilize your security baseline and record what happened for later reports.
Reset your Roblox password with a unique passphrase. Enable two-step verification by email or through an authenticator app. Sign out of other sessions in your account’s security settings so any stolen tokens become useless.
Audit nearby logins that reuse the same or similar passwords. Start with your email. Then check Discord and any cloud storage. Password reuse turns one mistake into a wider compromise. Change those logins to unique passphrases and turn on two-step verification in each account.
Remove anything you installed to pass “verification.” Uninstall the mobile apps and any browser extensions you added during the process. Remove desktop utilities that came from the same source. Run a full device scan with a reputable anti-malware tool. Update your operating system and your browsers.
Revoke external permissions you granted during tasks. Check the connected-app pages for Google and Apple. Then review Microsoft and Discord. Remove unknown integrations so stray tokens cannot call your data.
Cancel trial subscriptions you started for offers. If you see charges you did not expect, contact your card issuer. Dispute the transactions and request a block on future billing from the same merchants. Ask about chargeback windows and any extra monitoring the issuer can add.
If you used gift cards or prepaid codes at any point, contact the issuer now. Provide the card number and the purchase receipt if you have it. Some issuers can freeze remaining value or add flags that help trace abuse.
Watch for follow-on phishing tailored to your case. Expect messages that promise to deliver Robux after one more step, or that claim they can restore your account for a fee. Treat those contacts as a continuation of the attack and report them.
Report the incident inside Roblox through the abuse tools. Warn friends or servers where you may have shared the link. Early reporting helps enforcement teams find fresh domains faster and shortens the life of the campaign.
Spot-the-scam tells for 36k.my
This section helps you slow down the decision moment and see the seams. The template is sloppy on purpose. Without a timer pushing you, the rough edges stand out. Branding often looks off. Copy errors stack up. Promises rarely match the process. A brief pause and a second look reveal the structure beneath the gloss.
The first tell is the oversized promise. Pages flaunt five-figure Robux bundles and use sliders or prefilled amounts to keep eyes on the big prize. Real promotions, when they appear, are modest and transparent. Fantasy numbers exist to hijack attention and dull judgment.
The second tell is the clock. Countdowns pop up on every screen. “Only X codes left” adds scarcity where none exists. Fake concurrency counters show hundreds “claiming now.” Those timers are not logistics. They compress your decision window and mute skepticism.
The third tell is cosmetic “integration.” A username field that auto-detects your avatar is a trick, not a secure link to your account. No outside website can transfer Robux into your balance. Roblox does not permit external crediting.
The fourth tell is the moving “verification” wall. You complete two offers and the page asks for two more because the system “didn’t register” them. That is not a bug. Those extra tasks are the business model. More tasks create more payouts for the operators.
The fifth tell is the weak paper trail. Privacy policies read like templates full of errors. Company details are vague or missing. Support emails look generic. Domains rotate often. Legitimate services keep stable identities and contact paths you can trace.
Long-term defenses against Robux-site traps like 36k.my
This section gives durable habits that lower risk every day. It costs less to avoid the funnel than to fight your way out after the fact. Use the red-flag list above as your early warning, then layer protective steps that turn lures into dead ends.
Treat any “free Robux” offer as false unless it appears through official Roblox channels you can verify on the site itself. Off-platform giveaways that require external forms should be assumed fraudulent until proven otherwise.
Refuse “human verification” tasks on third-party sites. Surveys fund the operators. App installs pay affiliates. Trial sign-ups add recurring charges when you forget to cancel. The money moves because you perform the steps.
Keep strong, unique passphrases for Roblox and for your email. Do the same for Discord. Turn on two-step verification across those accounts. Your email deserves special care because it can reset the rest.
Reduce exposure to malvertising and sketchy redirects. Use an up-to-date browser on devices you use for gaming communities. Add an ad and tracker blocker to cut the “accidental click to bad landing page” path.
Limit link-hopping from YouTube comments and Discord DMs. Be wary of short-link hubs. When a click is required, check the domain closely. For known services, prefer typing a full address over tapping a link.
Review connected apps on major accounts on a regular cadence. Start with Google and Apple. Then check Microsoft and Discord. Remove tools you do not recognize. Each removal closes a path for token theft or silent data access.
Use Roblox’s family safety features on younger players’ profiles. Turn on an account PIN. Set privacy and contact limits. The guardrails make it harder for strangers to deliver the first lure.
Adopt a quick pause before committing. If a site flashes a timer or huge numbers, take one minute away from the screen. That short break resets attention and makes inconsistencies obvious again.
