roblox-revolver-script-auto-fan[.]pages[.]dev

This domain, roblox-revolver-script-auto-fan.pages.dev, is under investigation for credential theft targeting Roblox users. The page impersonates legitimate Roblox scripting resources, presenting itself as a source for an auto-firing revolver script. Analysis indicates the content is designed to harvest login credentials by exploiting user interest in game modifications, a common tactic in gaming-related credential theft campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on April 16, 2026, and resolves to the IP address 188.114.97.3, located in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt (serial number E8). Detection metrics show 0 out of 95 engines flagged the domain on VirusTotal, though it appears on one security blocklist. Google Safe Browsing status is not provided, but the domain remains unflagged by most major detection platforms. As of the latest assessment, the domain remains active and accessible. The lack of widespread detection suggests either recent deployment or evasion techniques. Users are advised to avoid interaction with the domain, particularly those seeking Roblox-related scripts or modifications. Organizations should monitor for credential exposure tied to this infrastructure and consider blocking the domain at network perimeter controls. Further investigation is required to determine the full scope of credential harvesting activity.