zenithexternal[.]pages[.]dev

Analysis of zenithexternal.pages.dev indicates this domain is actively impersonating Roblox as part of a crypto-drainer scam operation. The domain was registered on April 17, 2026, and is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.96.3, which is geolocated in Canada. The site presents itself with the page title 'Zenith — Free Roblox External,' explicitly targeting Roblox users. Infrastructure analysis reveals the use of Cloudflare nameservers (lana.ns.cloudflare.com and otto.ns.cloudflare.com), along with security technologies such as HSTS and HTTP/3, which are commonly employed to obscure malicious activity behind legitimate services. The domain currently returns an HTTP 200 status, confirming it is operational. A Let's Encrypt SSL certificate (serial number E7) is in place, providing encrypted connections that may lend a false sense of legitimacy. The domain has been assigned a trust score of 0/100 by Gridinsoft and appears on at least one security blocklist. While 94 vendors have scanned the domain on VirusTotal, none have flagged it at present; however, the absence of detections does not confirm safety, particularly given the domain's active status and confirmed association with crypto-draining activity. Defenders should treat this domain as high-risk due to its confirmed brand impersonation, scam classification, and use of Cloudflare to mask infrastructure details. The domain remains under investigation, and organizations are advised to block access to it at the network level, monitor for related indicators of compromise, and alert users to the threat posed by fraudulent Roblox-themed external services.