cerulean-entremet-a1aeb4[.]netlify[.]app

This domain, cerulean-entremet-a1aeb4.netlify.app, operates as a credential harvesting platform specifically targeting Roblox users. The page replicates the official Roblox login interface, presenting a fraudulent form designed to capture usernames, passwords, and potentially other sensitive account details. Analysis indicates the site employs social engineering tactics, exploiting the trust associated with the Roblox brand to deceive victims into submitting their credentials. The infrastructure is configured to exfiltrate stolen data to attacker-controlled servers, enabling unauthorized account access and potential financial fraud through in-game purchases or secondary phishing attacks. Infrastructure analysis reveals the domain was registered through Netlify on March 05, 2026, with an SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). The site resolves to IP address 63.176.8.218, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. Security vendor detections on VirusTotal show 17 out of 95 engines flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on one security blocklist, specifically PhishDestroy, confirming its classification as active phishing infrastructure. Users who have visited cerulean-entremet-a1aeb4.netlify.app or entered credentials on the site should immediately take corrective action. First, change the password for the affected Roblox account and any other platforms where identical credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts to mitigate unauthorized access. Monitor the account for suspicious activity, including unauthorized purchases or messages sent to contacts. If financial information was entered, contact the relevant financial institution to report potential fraud. Clear browser cache and cookies to remove any residual session data, and consider running a full system scan with updated security software to detect potential malware infections. Report the incident to the official Roblox security team and relevant cybersecurity authorities to aid in takedown efforts.