SafeMode - Analysis: www.rroblox.com.es

Visual Capture

Detection Info

http://www.rroblox.com.es/users/1919508547/profile

Detected Brand

Roblox

Country

International

Confidence

100%

HTTP Status

200

Report ID

777bef94-9c7…

Analyzed

2026-01-02 06:57

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1552132F05504A81E60E683C5BAB2B31E12E29290EF534D486BD86B9C0FDEE94D9542E9
CONTENT ssdeep	24:50kiHb6/QB0xi3G5wrspMDr7BvzkIAtjSg7B0S7ZEPlIqyXv1DqTF:qki7GxTwIpMrRoTBSgt0StsIqE1DqJ

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e4e4e44c6c6c6c79
VISUAL aHash	e766660000000000
VISUAL dHash	8eccd40210100000
VISUAL wHash	ffefe7e718180000
VISUAL colorHash	30007000000
VISUAL cropResistant	8eccd40210100000

Code Analysis

Risk Score 75/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer

🔬 Threat Analysis Report

• Threat: Brand impersonation phishing
• Target: Roblox users
• Method: Fake website to trick users into thinking it's Roblox
• Exfil: Unknown - but likely credential harvesting if the website had forms
• Indicators: Domain mismatch (rroblox.com.es vs roblox.com), obfuscated JavaScript, domain age unknown but likely recent
• Risk: HIGH - Potential for credential theft or malware installation

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

📡 API Calls Detected

/privacy.html
/chronos?dune=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.NoiZiPQKB433yeByBxIn9-w_HeeSa-OQco_20Wr4iwDdlvaJjenEzg.bKIE1ia9nNZR33oLk78_kg.vIbI7eWnKl_Q1JV_jjDsZDbK3IPt4INctumN3ZKS07OsJ682boplhw5QARTiEwtozeXK9sq5iBYo35JZXHHi7aJDvqM7QEJc-So29-_WUSyY-fLWB3A16MeuJbllB2bN2SNG-yXDaA8juMXDobc4EoROjVjrBb2okoq3mVilHaXMapOLvTJWzWT_2R9lLcvIiFxuAulr6lu1YrrLTYg5pO1UbZUtvugFEutVoeWealKbMslXP_3JvgArkeyk4baYdpcGRGKlcv-ihIsy1o9HcQdLhxH5wmQor0spESrZBv4wlqzPq66ECLYkvKWWE3wa.BioxWxk2rPW7etTgqO_UOA&t=69576c33&token=1f7cdef47d66f7dff1fb54e4dd95af687f6fb15c
POST
GET