noxgpt-roblox-mod-menu[.]pages[.]dev

The domain noxgpt-roblox-mod-menu.pages.dev is currently active and confirmed to host a fake Roblox mod menu phishing scheme. This threat specifically targets users seeking unauthorized game modifications, luring them with promises of cheats or exploits while harvesting credentials or distributing malware. Analysis indicates this is not a legitimate Roblox service but a fraudulent imitation designed to deceive players into downloading malicious payloads or entering sensitive account information. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 22, 2026, and resolves to the IP address 188.114.97.3, located in Canada. Security vendors have flagged this domain in 4 of 95 VirusTotal scans, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. The page title, 'Avoid NoxGPT Roblox Mod Menu: Risks,' is a deceptive tactic to mislead users into believing the content is a warning rather than the actual threat. Current status remains active, posing a high risk to users. Organizations and individuals are advised to block this domain at the DNS or firewall level. End users should be educated to recognize the signs of fake mod menus, including unsolicited download links, requests for account credentials, or prompts to disable security software. If interaction with the site has occurred, immediate password changes and malware scans are recommended. Network administrators should monitor for connections to 188.114.97.3 and review logs for any successful access attempts.