roblox-k-mvnt-8w4[.]pages[.]dev

Analysis of roblox-k-mvnt-8w4.pages.dev indicates a confirmed gaming‑related phishing operation targeting Roblox users. The domain was created on March 23, 2026 and is registered through Cloudflare, Inc., using the Cloudflare nameservers alexis.ns.cloudflare.com and nucum.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to Cloudflare’s network in Canada. The site served an HTTP 403 response, suggesting that access is currently blocked, and the connection is protected by HSTS and HTTP/3.

TLS termination is performed by a Google Trust Services certificate issued to the WE1 entity, confirming the use of a legitimate certificate chain. The page title "Robux Online" aligns with the listed scam type of a gaming scam, reinforcing the hypothesis that the site attempts to harvest credentials or payment information related to Roblox’s virtual currency. Security telemetry shows the domain appears on one public blocklist and is actively blocked by PhishDestroy. VirusTotal scans flagged the domain by two of ninety‑four security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious intent.

The overall risk rating is elevated, and the site is presently offline. Defenders should add the domain to internal URL filtering and DNS blocklists, monitor for any re‑registration or similar sub‑domains, and enforce strict outbound traffic controls to Cloudflare IP ranges when unsolicited connections are observed. Continuous threat‑intel feeds should be consulted for emerging indicators related to Roblox credential harvesting campaigns, and any user reports of unsolicited messages promising free Robux should be escalated for investigation.