SafeMode - Analysis: www.roblox.com.ml

Visual Capture

Detection Info

https://www.roblox.com.ml/games/17827854187/Untitled-Game?privateServerLinkCode=61854196322924534189301189554709

Detected Brand

Roblox

Country

International

Confidence

100%

HTTP Status

200

Report ID

73a1f5d7-bbc…

Analyzed

2026-01-13 23:38

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T19F13B772A1245C33A1AFA3D9F515B70591D3EB0ECB825BE2A1F8A37A09C9C71FD13416
CONTENT ssdeep	768:wC2ztXB1W8yLx0QmYym3byoSPorvrvEF3gkxvBRmMF9NpBxJ8m8:wC2ztXB1LyLxdmYym3rjMl7Xl9NTxJ8F

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b03033cfcfcc4c6c
VISUAL aHash	c7c7c3c7ffffffff
VISUAL dHash	8e1f0e2e363a3002
VISUAL wHash	02c783c3c7c3cfc3
VISUAL colorHash	070c3000000
VISUAL cropResistant	8e1f0e2e363a3002,3656d7a73757d472,01c16b5e1fc4c4f0

Code Analysis

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing attack targeting Roblox users.
• Target: Roblox users, especially those in Mali or those who might mistakenly trust the domain.
• Method: The attacker uses a fake Roblox website with a malicious domain and potentially a fake login form to steal user credentials.
• Exfil: Data exfiltration is likely done through a custom API or webhook controlled by the attacker.
• Indicators: The domain name is roblox.com.ml, the TLD is .ml (Mali), Obfuscated JavaScript, Form Actions
• Risk: HIGH - Immediate credential theft and potential account compromise.

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
js_packer
base64_strings

🎯 Kit Endpoints

https://www.roblox.com.ml/info/blog?locale=en_us
https://www.roblox.com.ml/catalog?CatalogContext=1&Keyword=
/catalog
/login?returnUrl=8627969222751465

📡 API Calls Detected

https://apis.
get
POST
https://ro.blox.com/Ebh5?pid=experiencestart_mobileweb&is_retargeting=false&af_dp=
https://en.help.roblox.com/hc/articles/7997207259156
GET