Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://https-www-rolblox.com/login?returnUrl=85772843
Detected Brand
Roblox
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
0a62d3ba-fa3…
Analyzed
2026-01-02 16:53
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F023947164686D33436B46DBF0B7AF1AB1D3C60CCA431891AAF853FE0BDAC72E615416 |
|
CONTENT
ssdeep
|
384:XjXyJL6Wv+pANrvu8WgfaZMWEiNu7lnEF1/1g85cgX3JUnJTS8No4FJP2N4pJNVI:XjXyVDWIAuyF9yi3X+nJzfvrVABUHc |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8c8d6262a3acf75a |
|
VISUAL
aHash
|
63181e3b1ce2183c |
|
VISUAL
dHash
|
87f132f2b88e3370 |
|
VISUAL
wHash
|
d7191e7b1ce2183c |
|
VISUAL
colorHash
|
39401008040 |
|
VISUAL
cropResistant
|
87f132f2b88e3370 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- https://www.roblox.com/tr/login
- https://www.roblox.com/id/login
- https://www.roblox.com/fr/login
- https://www.roblox.com/ar/login
- https://www.roblox.com/es/login
- https://www.roblox.com/it/login
- https://www.roblox.com/ja/login
- https://www.roblox.com/ko/login
- http://https-www-rolblox.com/catalog?CatalogContext=1&Keyword=
- https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4902752889650622&output=html&adk=935352056&adf=3869929943&lmt=1767372768&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=http%3A%2F%2Fhttps-www-rolblox.com%2Flogin%3FreturnUrl%3D85772843&pra=5&asro=0&aiapm=0.1542&aiapmd=0.1423&aiapmi=0.16&aiapmid=1&aiact=0.5423&aiactd=0.7&aicct=0.7&aicctd=0.5799&ailct=0.5849&ailctd=0.65&aimart=4&aimartd=4&aieuf=1&aicrs=1&abgtt=6&dt=1767372768286&bpp=33&bdt=1698&idt=132&shv=r20251211&mjsv=m202512100101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=939152834843&frm=20&pv=2&u_tz=0&u_his=2&u_h=1080&u_w=1920&u_ah=1080&u_aw=1920&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1920&bih=1080&scr_x=0&scr_y=0&eid=31096042%2C95366178%2C95376241%2C95378600%2C95378750%2C95379212%2C95379897&oid=2&pvsid=5483604330245550&tmod=1971146667&uas=3&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1920%2C0%2C1920%2C1080%2C1920%2C1080&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&plas=279x854_l%7C279x854_r&bz=1&pgls=CAk.&ifi=1&uci=a!1&fsb=1&dtd=168
- https://www.roblox.com/pt/login
- https://www.roblox.com/vi/login
- http://https-www-rolblox.com/develop/library?CatalogContext=2&Category=6&Keyword=
- /info/blog?locale=en_us
- /login/securityNotification
- https://www.roblox.com/th/login
- https://www.roblox.com/login
- https://www.roblox.com/login/forgot-password-or-username
- https://www.roblox.com/pl/login
- https://www.roblox.com/de/login
- /login?returnUrl=85772843
📡 API Calls Detected
- https://www.google.com/ccm/geo
- POST
- /api/cls_x9d2k3.php
- GET
- /api/cla_m4j8s1.php?session_id=
- https://ro.blox.com/Ebh5?pid=share&is_retargeting=true&af_dp=
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/ae1e59bd54f1.png
May 16, 2026
Roblox
http://httpps-www-roblox.co/login?returnUrl=67224868
May 14, 2026
Roblox
https://htpss-www-roblox.co/login?returnUrl=1337240167
Apr 28, 2026
Roblox
https://ihhttps-roblox.com/login?returnUrl=92269465
Apr 12, 2026
Roblox
https://httlpss-roblox.com/login?returnUrl=1481667911
Jan 03, 2026
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.