epicnpcroblox[.]pages[.]dev

This domain, epicnpcroblox.pages.dev, is currently flagged by the PhishDestroy blocklist as part of an active generic phishing campaign. Registration information shows the domain is provisioned through Cloudflare, Inc., and the authoritative name servers are marge.ns.cloudflare.com and quincy.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is owned by Cloudflare’s network and does not, by itself, reveal malicious intent. The domain appears on one public security blocklist, confirming that at least one external sinkhole has identified it as abusive.

VirusTotal has processed the domain with 91 scanning engines; none of the engines reported a detection at the time of analysis, however the absence of detections does not constitute evidence of safety. No additional public intelligence such as Google Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, or trust‑score metrics is presently available for this host. Consequently, the observable evidence is limited to the blocklist entry and the Cloudflare‑based infrastructure.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any new detections from additional scanning services, and consider adding the host to internal blacklists. Ongoing observation of the IP address 188.114.96.3 for any shift in reputation is recommended, as Cloudflare‑hosted IPs can be reused by unrelated actors. Until further forensic data (e.g., page title, payload samples) emerges, the domain remains classified as an active phishing vector targeting Roblox‑related users.