rivalmods[.]biz

This domain, rivalmods.biz, is identified as a brand impersonation phishing site targeting users seeking premium game modifications. Analysis indicates the domain was designed to mimic legitimate gaming mod distribution platforms, potentially to harvest credentials or distribute malicious payloads. The domain is currently offline, though prior activity suggests elevated risk due to its deceptive nature. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 10, 2026, and resolved to the IP address 172.67.136.50. Security vendor detections include 17 of 95 flags on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse. Additional scrutiny confirms its inclusion in at least one proprietary detection system prior to takedown. The domain’s current offline status reduces immediate risk, though historical indicators warrant caution. Users who interacted with rivalmods.biz are advised to scan systems for malware, reset any credentials entered on the site, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP, while security teams are encouraged to review logs for prior connections to 172.67.136.50. Future monitoring of domains registered through the same registrar may help identify related threats.