robloxstudiopluginswordbuilder[.]pages[.]dev

This domain is currently under investigation for credential theft targeting Roblox Studio plugin users. Analysis indicates the site impersonates legitimate Roblox development tools, specifically a 'Sword Builder' plugin, to harvest login credentials from developers. The threat type is classified as credential theft with brand impersonation, focusing on the Roblox ecosystem. Infrastructure analysis reveals the domain robloxstudiopluginswordbuilder.pages.dev was registered through Cloudflare, Inc. and resolves to the IP address 188.114.97.3. The domain was created on April 14, 2026, though this future date suggests potential falsification of registration records. It appears on one security blocklist, while VirusTotal shows 0 detections out of 95 engines. The SSL certificate is issued by Google Trust Services (WE1), which may lend superficial legitimacy to the site. Users should exercise caution when encountering this domain, particularly if prompted to enter Roblox account credentials. Mitigation steps include verifying plugin authenticity through official Roblox channels, enabling multi-factor authentication on developer accounts, and cross-referencing plugin sources with the Roblox Developer Forum. Organizations should update web filtering rules to block access to this domain and monitor for credential reuse attempts from potentially compromised accounts. The future-dated registration warrants additional scrutiny of the domain's infrastructure for further indicators of compromise.