rivalsfreeroblox[.]pages[.]dev

PhishDestroy identifies rivalsfreeroblox.pages.dev as a live generic phishing domain distributing a fake Roblox Rivals code generator to harvest user credentials and drain crypto wallets. The page masquerades as a legitimate ‘Free Karambit’ giveaway, enticing victims with expired Roblox promo codes to trick them into connecting cryptocurrency wallets under the guise of receiving a virtual item reward. No advanced drainer kit artifacts are visible on the landing page, but the threat actor’s infrastructure suggests a staged campaign targeting Roblox players who seek rare in-game items.

This domain was flagged by PhishDestroy with the seed b8b069. Technical indicators include a VirusTotal detection score of 1/95, a Cloudflare Inc. registration via Cloudflare Pages, and a Let’s Encrypt SSL certificate. The domain resolves to IP 172.66.44.209 and is currently served from Cloudflare’s edge network. GSB (Google Safe Browsing) has not yet classified this URL, and third-party blocklists show zero prior listings. The registration timestamp and additional WHOIS data remain under forensic review due to Cloudflare’s privacy protection.

As of this report, rivalsfreeroblox.pages.dev remains active and is actively serving the fraudulent Roblox Rivals code page. PhishDestroy has flagged the domain and added it to the internal threat database for real-time blocking. The residual risk remains high due to the absence of AV detections and the use of trusted infrastructure (Cloudflare, Let’s Encrypt). Users are strongly advised to avoid interacting with this domain, verify any Roblox-related links on PhishDestroy, and enable wallet address verification prompts before connecting to any third-party sites. The threat actor may pivot quickly to new domains, so continuous monitoring is recommended.