EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

No screenshot available

Detection Info

https://wvvw-roblox.com.ru/login?returnUrl=604164043
Detected Brand
Roblox
Country
International
Confidence
100%
HTTP Status
200
Report ID
3bb0a804-9df…
Analyzed
2025-12-20 14:54

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T14313957164682933432B46DBF0B7AF1AB1D3C64CCA431891AAFC53ED0BDBC72EA45546
CONTENT ssdeep
384:XjXQLthI6lNrVunWLKaZMWEiNuqlnEF1/1g85cgX3JUxHTVMNo4FJPGN4pJNFN4i:XjXQ5hKWcAuTF9yi3X+xHevPRvAdEHD

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
c8c8e262ebf8e362
VISUAL aHash
d91818180000003c
VISUAL dHash
33b2b23230082060
VISUAL wHash
ff3c3c3c1800007e
VISUAL colorHash
380000001c0
VISUAL cropResistant
33b2b23230082060

Code Analysis

Risk Score 100/100
Threat Level ALTO
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing attack
• Target: Roblox users
• Method: Fake login page to steal usernames and passwords
• Exfil: Unknown, likely to a malicious server controlled by the attacker
• Indicators: Domain name is wvvw-roblox.com.ru, which is not the official Roblox domain. The page includes a login form, indicating an attempt to steal credentials.
• Risk: HIGH - Users entering their credentials on this page risk having their Roblox accounts compromised.

🎯 Kit Endpoints

  • https://www.roblox.com/login/forgot-password-or-username
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4902752889650622&output=html&adk=935352056&adf=3869929943&lmt=1766242431&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwvvw-roblox.com.ru%2Flogin%3FreturnUrl%3D604164043&pra=5&asro=0&aiapm=0.1542&aiapmd=0.1423&aiapmi=0.16&aiapmid=1&aiact=0.5423&aiactd=0.7&aicct=0.7&aicctd=0.5799&ailct=0.5849&ailctd=0.65&aimart=4&aimartd=4&aieuf=1&aicrs=1&uach=WyJXaW5kb3dzIiwiMTAuMCIsIng4NiIsIiIsIjE0MC4wLjczMzkuMTYiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNDAuMC43MzM5LjE2Il0sWyJOb3Q9QT9CcmFuZCIsIjI0LjAuMC4wIl0sWyJIZWFkbGVzc0Nocm9tZSIsIjE0MC4wLjczMzkuMTYiXV0sMF0.&abgtt=6&dt=1766242430591&bpp=31&bdt=3767&idt=560&shv=r20251211&mjsv=m202512100101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=452585870287&frm=20&pv=2&u_tz=0&u_his=2&u_h=1080&u_w=1920&u_ah=1080&u_aw=1920&u_cd=24&u_sd=1&dmc=4&adx=-12245933&ady=-12245933&biw=1920&bih=1080&scr_x=0&scr_y=0&eid=31095903%2C31096042%2C95376241%2C95376582%2C95378749%2C95379212%2C95379652&oid=2&pvsid=1360218083529339&tmod=406530434&uas=3&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1920%2C0%2C1920%2C1080%2C1920%2C1080&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&plas=279x732_l%7C279x732_r&bz=1&pgls=CAk.&ifi=1&uci=a!1&fsb=1&dtd=615
  • https://wvvw-roblox.com.ru/develop/library?CatalogContext=2&Category=6&Keyword=
  • https://www.roblox.com/NewLogin
  • https://wvvw-roblox.com.ru/catalog?CatalogContext=1&Keyword=
  • /login?returnUrl=604164043
  • /login/securityNotification
  • /info/blog?locale=en_us

📡 API Calls Detected

  • POST
  • GET
  • https://www.google.com/ccm/geo
  • https://ro.blox.com/Ebh5?pid=share&is_retargeting=true&af_dp=

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Roblox
https://1https-www-roblox.com/login?returnUrl=81308525
Jan 05, 2026
No screenshot
Roblox
https://lhttps-www-roblox.com/login?returnUrl=9040613
Dec 07, 2025

Scan History for wvvw-roblox.com.ru

Found 1 other scan for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.