slizzygives[.]pages[.]dev

Analysis of slizzygives.pages.dev shows a clear attempt to impersonate the Roblox brand by offering a $100 Robux Gift Card in the page title “$100 Robux Gift Card - Rewards Event.” The domain was created on March 12, 2026 and is registered through Cloudflare, Inc., using the nameservers braelyn.ns.cloudflare.com and rex.ns.cloudflare.com. Infrastructure inspection reveals that the hostname resolves to IP address 172.66.47.71, which belongs to AS13335 owned by Cloudflare and is geolocated in the United States. The site served an HTTP 403 response, indicating that access was deliberately denied, and the connection employed HSTS and HTTP/3, confirming modern TLS enforcement. The SSL certificate was issued by Google Trust Services under the WE1 trust chain, providing a valid HTTPS endpoint despite the site being offline.

Threat intelligence sources have flagged the domain: PhishDestroy has blocked it, it appears on one external blocklist, and VirusTotal recorded detections from 2 of 94 security vendors. Additionally, Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Current status is taken offline, limiting immediate exposure but leaving the infrastructure in place for potential re‑use.

Uncertainties remain around the specific payload or credential harvesting mechanisms, as no page content beyond the title has been captured. Defenders should add the domain and its resolved IP to network blocklists, monitor for any re‑registration or similar subdomains under the same Cloudflare account, and enforce brand‑specific URL filtering for Roblox‑related keywords. Continuous observation of Cloudflare‑hosted assets associated with the same ASN is advised, as threat actors often reuse the same edge infrastructure for future campaigns.