EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of www.roblox.com.ml

Detection Info

https://www.roblox.com.ml/games/6237245040/Bloxstrap-Account-Link?privateServerLinkCode=88365510440119588817145833314433
Detected Brand
Roblox
Country
International
Confidence
100%
HTTP Status
200
Report ID
408f5edc-278โ€ฆ
Analyzed
2026-02-10 00:26

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T10313B872A1245C33A1AFA3D9F515B70691D3EB0ECA435BE2A2F8A3760AC5C71FD13416
CONTENT ssdeep
768:0kTdYsXB1W8yLx6QZFGXbyI7mPprvrvEk314DvBRW0lMF9NpBxJ8m8:0kTdYsXB1LyLxfZFGXTqjM28XWH9NTx8

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b03030cfcdcd6d4d
VISUAL aHash
c7c7c3cfffffffdf
VISUAL dHash
8e0f8e1e221a38be
VISUAL wHash
028383c3cfc7cfc3
VISUAL colorHash
07000000180
VISUAL cropResistant
8e0f8e1e221a38be,e8c8c8f0f0f0e9e8

Code Analysis

Risk Score 100/100
Threat Level ALTO
โš ๏ธ Phishing Confirmed
๐ŸŽฃ Credential Harvester ๐ŸŽฃ OTP Stealer ๐ŸŽฃ Card Stealer ๐ŸŽฃ Banking ๐ŸŽฃ Personal Info

๐Ÿ”ฌ Threat Analysis Report

โ€ข Threat: Credential Phishing
โ€ข Target: Roblox users
โ€ข Method: Impersonation and Social Engineering
โ€ข Exfil: Unknown (likely Roblox credentials)
โ€ข Indicators: Domain mismatch, Verification pretext, Obfuscation
โ€ข Risk: High

๐Ÿ” Credential Harvesting Forms

๐Ÿ”’ Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • hex_escape
  • unicode_escape
  • base64_strings

๐ŸŽฏ Kit Endpoints

  • https://trades.
  • https://en.help.roblox.com/hc/
  • https://search.
  • https://sourcemaps.rbxcdn.com/reactStyleGuide-9aa4afe792195bbe.js.map
  • https://voice.
  • /catalog
  • https://feross.org
  • https://api.
  • https://js.rbxcdn.com/03f028f20886b6abeb9896bfdc7c6deebcd2c1012cca05b8bd8e774c6b75327b.js
  • https://itemconfiguration.
  • https://inventory.
  • https://tarobi-dev-test.com
  • https://js.rbxcdn.com/0a132f4c28836d35a2e3d8ece4dd7f2a8b9c829ec380e97a3275fd1c276fd258.js
  • https://js.rbxcdn.com/5c8a2ba3737908f693394045e81ebd71c77cde6f87550ea51f7833e8c98200ae.js
  • https://engagementpayouts.
  • https://feross.org/opensource
  • https://roblox.com
  • https://www.roblox.com.ml/catalog?CatalogContext=1&Keyword=
  • https://followings.
  • https://chat.
  • https://js.rbxcdn.com/d8ebdb41a9d5df4ee618138bca4e1663975b7134d68c138418ad9a76cd031a2a.js
  • https://sourcemaps.rbxcdn.com/internationalCore-db1cf6cdaa102b16.js.map
  • https://ั‚ะตัั‚
  • https://sourcemaps.rbxcdn.com/coreUtilities-ec87339a9f5f1ae7.js.map
  • https://accountsettings.
  • https://sourcemaps.rbxcdn.com/translationResources-69e5843ef57e17f4.js.map
  • https://a
  • https://app.lightstep.com
  • https://a/c%20d?a=1&c=3
  • https://mui.com/production-error/?code=
  • https://premiumfeatures.
  • https://www.rblx.org
  • /login?returnUrl=756857461400389
  • https://www.roblox.com.ml/info/blog?locale=en_us

๐Ÿ“ก API Calls Detected

  • https://ro.blox.com/Ebh5?pid=experiencestart_mobileweb&is_retargeting=false&af_dp=
  • get
  • https://en.help.roblox.com/hc/articles/7997207259156
  • POST
  • GET
  • https://apis.

๐Ÿ“ค Form Action Targets

  • /search

๐Ÿ“Š Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Domain mismatch
The domain is not roblox.com, it uses a suspicious TLD.
Obfuscation
Obfuscation techniques (atob, eval, fromCharCode) are detected
Impersonation Attempt
The page tries to look like Roblox and has a call to action to verify.

๐Ÿ”ฌ Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
Roblox users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with HTTP POST to backend

โš ๏ธ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 230 obfuscation techniques

๐Ÿข Brand Impersonation Analysis

Impersonated Brand
Roblox
Official Website
https://www.roblox.com
Fake Service
Roblox account verification

Fraudulent Claims

โš”๏ธ Attack Methodology

Primary Method: Credential Harvesting

The site is attempting to trick users into entering their Roblox login credentials. The 'verification' process is a social engineering tactic to steal account information.

Secondary Method: Obfuscation

The site utilizes Javascript obfuscation to hide its malicious intent from simple detection.

๐ŸŒ Infrastructure Indicators of Compromise

๐Ÿฆ  Malicious Files

Main File
EnvironmentUrls.js
File Size

๐Ÿ”ฌ JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
3.8ย MB

๐Ÿ”— API Endpoints Detected

Other
93

๐Ÿ” Obfuscation Detected

  • : None
  • : Light
  • : Heavy
  • : None
  • : None
  • : Light
  • : None
  • : None
  • : Light
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : Heavy
  • : None
  • : Heavy
  • : Heavy
  • : Light
  • : Heavy

๐Ÿค– AI-Extracted Threat Intelligence

๐ŸŽฏ Malicious Files Identified

Main Drainer
EnvironmentUrls.js
File Size
3872KB

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Roblox
https://www.roblox.com.bi/games/128915436393653/Dongdaemun-G...
May 31, 2026

Scan History for www.roblox.com.ml

Found 10 other scans for this domain

๐Ÿ˜ฐ
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.