roblox-rocash[.]pages[.]dev

The domain roblox-rocash.pages.dev was created on 23 March 2026 and is hosted behind Cloudflare’s network, resolving to IP 172.66.44.99 located in Canada. The site employed HSTS and HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 hierarchy, indicating a valid HTTPS endpoint. The page title observed during the brief crawl was “UGC Cash”, and the domain was explicitly catalogued as impersonating the Roblox brand and classified as a gaming‑scam type. Infrastructure analysis shows the domain is registered through Cloudflare, Inc., using the nameservers everton.ns.cloudflare.com and kia.ns.cloudflare.com.

A trust assessment by Gridinsoft assigned a score of 0 out of 100, reflecting a lack of reputable reputation. VirusTotal scanning reported that ten of ninety‑four security vendors flagged the domain, and it appears on one external blocklist, confirming that multiple security products consider it malicious. The domain was blocked by the PhishDestroy community, and its current HTTP status is offline, indicating that the site has been taken down or is no longer serving content. Evidence from the available intelligence confirms that the domain is actively leveraging a popular brand name to lure victims, but no live content was reachable at the time of analysis, limiting verification of payload or credential‑harvesting mechanisms.

Defenders should continue to deny any network traffic to 172.66.44.99, enforce DNS filtering for roblox-rocash.pages.dev, and add the domain to existing brand‑protection blocklists for Roblox. Ongoing monitoring of Cloudflare‑associated subdomains is advised, as the infrastructure could be reused for future impersonation campaigns. Until further content is observed, the prevailing risk remains elevated due to the confirmed brand impersonation and the low trust score.