Phishing Analysis: Roblox

Visual Capture

Detection Info

https://www.robiox.com.py/games/142823291/Murder-Mystery-2?privateServerLinkCode=554407681611406119444591868225

Detected Brand

Roblox

Country

International

Confidence

100%

HTTP Status

200

Report ID

af4d8c11-c15…

Analyzed

2026-01-02 07:55

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T18B23967262211833A17BA3DAF515B75591E3E70FC7835BE2E1F8A3660ACAC21FD03516
CONTENT ssdeep	768:aclXW11rlbWFTJbyPz63rvrvEp396W7vBR988YeyQ3qdiEK:aclXW11rlCFTJfjMZjX9VYTxiEK

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b03032cfcfcd6c4c
VISUAL aHash	c7c7c3cfffffffff
VISUAL dHash	9e0f0e1e341c0a30
VISUAL wHash	028783c3c7c7c3cf
VISUAL colorHash	07200008080
VISUAL cropResistant	9e0f0e1e341c0a30,261494d44455cc54

Code Analysis

Risk Score 95/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Roblox game impersonation
• Target: Roblox users
• Method: Displays a fake Roblox game page to mislead users
• Exfil: N/A - likely redirect to a malicious site or download
• Indicators: Domain name variation, brand impersonation
• Risk: HIGH - Could lead to malware download or account compromise

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
js_packer
base64_strings

🎯 Kit Endpoints

/info/blog?locale=en_us
/NewLogin?returnUrl=
https://www.robiox.com.py/games/7041939546/Catalog-Avatar-Creator?isAd=false&nativeAdData=&numberOfLoadedTiles=6&page=gameDetailPage&placeId=7041939546&position=3&universeId=2711375305
https://www.roblox.com/catalog
https://www.robiox.com.py/NewLogin?returnUrl=https%3A%2F%2Fwww.roblox.com%2Fgames%2F233655451648%2FMurder-Mystery-2
https://www.roblox.com/catalog?CatalogContext=1&Keyword=

📡 API Calls Detected

https://help.roblox.com/hc/articles/30428367965460
get
https://apis.
https://ro.blox.com/Ebh5?pid=experiencestart_mobileweb&is_retargeting=false&af_dp=
POST
GET