roblox-sky-tool-script-auto-box[.]pages[.]dev

This domain, roblox-sky-tool-script-auto-box.pages.dev, is currently under investigation for operating as a Roblox credential phishing site. The page impersonates legitimate Roblox auto-farming scripts, specifically targeting users with promises of an automated "Sky Tool Script Auto Box" for in-game resource farming. The threat type is classified as generic phishing, with a focus on harvesting user credentials and account access details. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages and resolves to the IP address 188.114.96.3, located in Canada under Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt (serial number E8), a common but not inherently malicious provider. The domain was registered on April 16, 2026, and appears on one security blocklist, though it has not yet been flagged by any of the 95 vendors on VirusTotal. The page title, "Using a Roblox Sky Tool Script Auto Box for Easy Farming | Roblox Sky Tool Script Auto Box," aligns with known phishing tactics designed to lure victims with false automation tools. Current status remains active, and while initial detections are limited, the domain exhibits multiple indicators of compromise. Users are advised to avoid interaction, and security teams should monitor for credential submission attempts or redirects to secondary payloads. Blocking the domain at the network level and alerting potential targets within gaming communities are recommended mitigations. Further investigation into associated infrastructure and hosting patterns is warranted to determine the full scope of the campaign.