EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of www.roblox.com.ml

Detection Info

https://www.roblox.com.ml/users/4032497628/profile
Detected Brand
Roblox
Country
International
Confidence
100%
HTTP Status
200
Report ID
f6d55d34-a5c…
Analyzed
2026-01-25 18:12

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T16573867292102437617B79DAF165771AA2D3C70FCA8256E1A2F8939A0FD6CE1FC1740E
CONTENT ssdeep
1536:yYVXWn9r16a+4ouuMYeYuOne2kZ57Hb7HD7H/7Hy7Hv7H37HE7H37Hn7HF7H37Hz:bVXWT6a4RXLuO4777j7f7S7P7X7k7X7R

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b4164363999cbcbc
VISUAL aHash
0000c3ffc3c3ffff
VISUAL dHash
e8c826301e1e0006
VISUAL wHash
0000c3dfc3c3ffe3
VISUAL colorHash
07009010080
VISUAL cropResistant
e8c826301e1e0006

Code Analysis

Risk Score 100/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing kit
• Target: Roblox users
• Method: Fake login form stealing user credentials
• Exfil: Data sent to unknown server
• Indicators: Domain mismatch, obfuscated JavaScript, form submission
• Risk: HIGH - Immediate credential theft

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • hex_escape
  • unicode_escape
  • js_packer
  • base64_strings

🎯 Kit Endpoints

  • https://www.roblox.com/catalog/607702162/null
  • https://www.roblox.com.ml/info/blog?locale=en_us
  • /login?returnUrl=8220380350573181
  • https://www.roblox.com/catalog/2510240941/null
  • https://www.roblox.com/catalog/2510233257/null
  • https://www.roblox.com/catalog/12995017412/null
  • /catalog
  • https://www.roblox.com/catalog/10647852134/null
  • https://www.roblox.com/catalog/2510238627/null
  • https://www.roblox.com/catalog/2510235063/null
  • https://www.roblox.com/catalog/12995015868/null
  • https://www.roblox.com/catalog/12995018829/null
  • https://www.roblox.com/catalog/2510236649/null
  • https://www.roblox.com/catalog/10638267973/null
  • https://www.roblox.com/catalog/607785314/null
  • https://www.roblox.com/catalog/2510230574/null
  • https://www.roblox.com/catalog/301811432/null
  • https://www.roblox.com/catalog/12995014400/null
  • https://www.roblox.com/catalog/12995020128/null
  • https://www.roblox.com.ml/catalog?CatalogContext=1&Keyword=
  • https://www.roblox.com/catalog/2510242378/null

📡 API Calls Detected

  • get
  • https://apis.
  • https://ro.blox.com/Ebh5?
  • https://help.roblox.com/hc/articles/30428367965460
  • POST
  • babylonjs
  • GET

📤 Form Action Targets

  • /search

📊 Risk Score Breakdown

Total Risk Score
100/100

Contributing Factors

Active Phishing Kit
Detected Credential Harvester, OTP Stealer, Card Stealer, and Banking kits with real-time form interception capabilities.
Domain Impersonation
Domain www.roblox.com.ml mimics the official Roblox domain (roblox.com) using a misleading TLD (.ml).
Obfuscation Techniques
929 obfuscation techniques detected, indicating heavy code concealment to evade detection.
Malicious JavaScript Files
Large JavaScript files (3.54 MB total) with no legitimate purpose, likely containing malicious payloads.

🔬 Comprehensive Threat Analysis

Threat Type
Credential Theft (Fake Roblox Login)
Target
Roblox users (International)
Exfiltration Channel
HTTP POST

🏢 Brand Impersonation Analysis

Impersonated Brand
Roblox
Official Website
https://www.roblox.com
Fake Service
User profile access and account management

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit captures user credentials via a fake login form mimicking Roblox's authentication process. Submitted data is exfiltrated in real-time to an attacker-controlled server.

Secondary Method: Personal and Financial Information Theft

Additional forms target sensitive user data, including OTP codes, credit card details, and Banking information, enabling account takeover and financial fraud.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
www.roblox.com.ml
Registered
Unknown
Registrar
Unknown
Status
Active (age unknown)

🦠 Malicious Files

Main File
File Size

Large JavaScript files containing obfuscated code for credential harvesting and data exfiltration.

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
3.5 MB

🔗 API Endpoints Detected

Other
111

🔐 Obfuscation Detected

  • : None
  • : Light
  • : Heavy
  • : None
  • : None
  • : Light
  • : None
  • : None
  • : None
  • : None
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : Heavy
  • : None
  • : None
  • : Heavy
  • : Heavy

🤖 AI-Extracted Threat Intelligence

🎯 Malicious Files Identified

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Roblox
https://www.robiox.com.gr/users/4288016669/profile
May 15, 2026
 Screenshot
Roblox
https://www.roblox.com.ml/users/3031900643/profile
Feb 03, 2026
 Screenshot
Unknown
http://www.robiox.com.ua/users/5530859588/profile/
Jan 29, 2026
 Screenshot
Roblox
https://www.roblox.com.ml/users/7624748411/profile
Jan 25, 2026
 Screenshot
Roblox
https://www.roblox.com.ml/users/5082337600/profile
Jan 23, 2026

Scan History for www.roblox.com.ml

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.