rivalsroblox[.]pages[.]dev

PhishDestroy identifies an active crypto-draining campaign hosted at rivalsroblox.pages.dev, currently impersonating the Roblox gaming platform. The domain is categorized as a generic phishing vector with under-investigation status, indicating active threat activity and potential for credential theft or cryptocurrency asset exfiltration. Users are advised to treat this domain as hostile and refrain from any interaction.

This domain resolves to IP address 188.114.96.3 and is served via Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. As of the latest scan, it remains undetected by VirusTotal, with 0 out of 95 security vendors flagging it. The domain is registered through Cloudflare’s Pages service, leveraging legitimate infrastructure to evade detection. No blocklist entries or public reputation scores are currently associated with this domain, reinforcing its stealthy deployment and emerging threat profile.

The campaign is active and evolving, with no known takedown or remediation at this time. Given the use of a crypto drainer mechanism—likely embedded within a fake Roblox rewards or giveaway page—users risk direct financial loss upon interaction. PhishDestroy recommends immediate network and endpoint blocking of the domain rivalsroblox.pages.dev and its resolving IP 188.114.96.3. Additionally, users should verify any Roblox-related links via official channels and avoid downloading unverified browser extensions or entering credentials on non-official pages. Organizations are advised to update threat intelligence feeds and SIEM rules to monitor for this indicator.