escapetsunam[.]pages[.]dev

This domain, escapetsunam.pages.dev, is flagged as a generic phishing resource targeting Roblox users through a fabricated rewards portal. Analysis of the page title, Roblox Rewards Hub, indicates an attempt to deceive users into submitting login credentials or personal information under the guise of in-game incentives. No drainer kit signatures have been identified at this stage, though the infrastructure aligns with common phishing deployment patterns observed in credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 28, 2026, and currently resolves to the IP address 188.114.97.3, located in Canada under Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may contribute to the site’s initial appearance of legitimacy. VirusTotal reports zero detections across 95 engines, suggesting the threat has not yet been widely recognized. However, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed, indicating preliminary detection by automated systems. The domain remains active and under investigation, with no takedown or sinkholing actions observed as of this assessment. The combination of zero detections on VirusTotal and a single blocklist presence suggests the threat is either newly deployed or employs evasion techniques to avoid detection. Users are advised to treat any interaction with escapetsunam.pages.dev as high-risk, particularly if prompted for Roblox credentials or payment details. Organizations should monitor for connections to 188.114.97.3 and the domain itself in network logs, and consider implementing DNS-based blocking for the domain to prevent potential credential compromise.