# mod-master-for-roblox.pages.dev — SUSPICIOUS

> PhishDestroy warns of a Roblox crypto drainer on mod-master-for-roblox.pages.dev mimicking official pages.

## Summary
PhishDestroy identifies mod-master-for-roblox.pages.dev as an active crypto drainer impersonating Roblox modding tools, posing an immediate risk to cryptocurrency assets. This domain resolves to IP 172.66.46.222 and remains undetected by 0/95 VirusTotal scanners as of investigation seed 864ac1. Registered through Cloudflare, Inc., the domain utilizes a Google Trust Services SSL certificate, suggesting superficial legitimacy while actively distributing malicious payloads to drain connected wallets.  Technical indicators include a Cloudflare-resolved IP (172.66.46.222) and a Google Trust Services SSL certificate, which may mislead users into trusting the domain. The absence of VirusTotal detections (0/95) indicates low signature-based detection despite active malicious activity. As a Pages.dev subdomain, it leverages legitimate cloud services to obscure its true intent, targeting users searching for Roblox modding tools with fake login portals designed to harvest wallet credentials and initiate unauthorized transactions.  Mitigation requires immediate user action: avoid interacting with mod-master-for-roblox.pages.dev or any Pages.dev subdomains offering Roblox mods. Verify domain authenticity through PhishDestroy’s real-time threat intelligence before downloading files or entering credentials. Use hardware wallets or transaction approval delays to mitigate drainer risks, and report suspicious domains to PhishDestroy for rapid blacklisting. Cloudflare’s infrastructure must be scrutinized for abuse, as threat actors increasingly exploit legitimate services to host crypto drainers.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.222

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/f53098cb-376b-4d7a-a4ad-4881eea0f071
- PhishDestroy: https://phishdestroy.io/domain/mod-master-for-roblox.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/mod-master-for-roblox.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/mod-master-for-roblox.pages.dev/
Last updated: 2026-03-26