arceus-roblox[.]pages[.]dev

PhishDestroy identifies the active domain arceus-roblox.pages.dev engaged in Roblox brand impersonation aimed at credential theft, currently under investigation with a risk level classified as active.

Analysis of the infrastructure reveals this domain resolves to 188.114.96.3 and leverages a Google Trust Services SSL certificate. The site is hosted behind Cloudflare, Inc. registrar services. At present, VirusTotal records zero detections out of 95 vendor engines, indicating this threat remains undetected by mainstream scanning platforms. No historical blocklist data or creation date is publicly available at this stage, which increases the risk of successful user compromise.

Given the absence of threat intelligence coverage and the domain’s active status, organizations should immediately block arceus-roblox.pages.dev at DNS and firewall levels. Implement user awareness training emphasizing caution when accessing Roblox-related domains outside official channels. Continuous monitoring of outbound traffic to 188.114.96.3 is recommended to identify potential callback or exfiltration attempts. The seed identifier 8e351c should be used to track this advisory across security controls.