coodus[.]pages[.]dev

This domain, coodus.pages.dev, is actively impersonating a legitimate gaming currency purchase portal to deceive users into entering account credentials or payment details. The page displays a fraudulent interface mimicking the official Robux purchase workflow, targeting players of a widely used gaming platform. Victims are prompted to log in or provide financial information under the pretense of completing a transaction, leading to credential theft or unauthorized charges. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.52. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, indicating the threat has not yet been widely flagged. The SSL certificate is issued by Google Trust Services, providing a false sense of security to visitors. No blocklist entries or historical abuse reports were identified at the time of assessment, suggesting the campaign is either new or evading detection through rapid domain rotation. Users who have visited coodus.pages.dev or interacted with its content should immediately revoke any entered credentials, particularly for gaming or payment accounts. Monitor financial statements for unauthorized transactions and enable multi-factor authentication on all linked services. If personal or payment data was submitted, consider reporting the incident to relevant fraud protection authorities. Network administrators are advised to block the domain and its resolving IP (172.66.44.52) at the perimeter to prevent further exposure within their environments.