getrivals[.]pages[.]dev

This domain, getrivals.pages.dev, is currently active and engaged in credential theft targeting users of the Roblox gaming platform. The page impersonates a legitimate source for in-game items, specifically offering free Karambit codes—a high-value virtual item—under the false pretense of being unexpired. Analysis indicates the domain is designed to harvest login credentials or other sensitive information from unsuspecting victims attempting to claim the advertised rewards. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 28, 2026, and resolves to the IP address 188.114.97.3, located in Canada and associated with Cloudflare’s network infrastructure. As of the latest assessment, the domain has been flagged by one security blocklist (PhishDestroy) but remains undetected by all 95 vendors on VirusTotal, indicating a low initial detection rate. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common but not inherently malicious certificate authority, which does not mitigate the domain’s fraudulent intent. The page title, 'Roblox Rivals Codes for Karambit (Not Expired) | Free Karambit,' is crafted to exploit user trust and urgency, a hallmark of credential theft campaigns. Current status confirms the domain remains operational, posing an ongoing risk to Roblox users. Security teams are advised to classify this domain as malicious and implement blocking measures at the network and endpoint levels. Users should be educated to verify the authenticity of any offers involving in-game items, particularly those requiring login credentials or personal information. Monitoring for similar domains registered under Cloudflare’s infrastructure or resolving to the same IP range (188.114.96.0/20) may help identify related threats. Organizations should treat this as a high-priority credential theft campaign due to its targeted nature and active status.