arceus-x-apk-download[.]pages[.]dev

Analysis of arceus-x-apk-download.pages.dev shows the site was registered on March 30 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP 172.66.47.94 located in Canada. The domain serves content over HTTPS using a Google Trust Services certificate (WE1) and presents HTTP/3 with HSTS enabled. The page title “Download Arceus X APK: Roblox Exploit Guide | Arceus X Apk Download” explicitly references Roblox, and the threat classification is a gaming‑related scam that purports to provide an APK for a Roblox exploit. The infrastructure uses Cloudflare’s brit.ns.cloudflare.com and gannon.ns.cloudflare.com name servers and includes YouTube and DTScout scripts, suggesting possible content delivery or analytics components. The site is listed on a single security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. No detections have been reported by VirusTotal, but the absence of flags does not confirm safety. The exact malicious payload or credential‑harvesting mechanism has not been observed, and the page content has not been manually inspected. Defenders should treat the domain as malicious, block network requests to the IP address and to the full domain, and monitor for any outbound connections that may involve the embedded YouTube or DTScout resources. Email filters should flag any messages containing references to “Arceus X APK” or “Roblox exploit guide.” Ongoing telemetry should be collected to verify whether the site begins distributing malware or harvesting user data.