urlscan.io logo urlscan.io
SecurityTrails logo

rbxhr.net Open in urlscan Pro
45.76.65.42  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://rbxhr.net/
Effective URL: https://rbxhr.net/
Submission Tags: @phish_report
Submission: On January 27 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 45.76.65.42, located in Los Angeles, United States and belongs to AS-CHOOPA, US. The main domain is rbxhr.net.
TLS certificate: Issued by R3 on January 27th 2024. Valid for: 3 months.
This is the only time rbxhr.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Roblox (Gaming)

Domain & IP information

IP Address AS Autonomous System
1 3 45.76.65.42 20473 (AS-CHOOPA)
8 99.86.4.80 16509 (AMAZON-02)
10 2
Apex Domain
Subdomains		 Transfer
8 oktacdn.com
ok1static.oktacdn.com — Cisco Umbrella Rank: 18737
677 KB
3 rbxhr.net
rbxhr.net
4 KB
10 2
Domain Requested by
8 ok1static.oktacdn.com rbxhr.net
ok1static.oktacdn.com
3 rbxhr.net 1 redirects rbxhr.net
10 2

This site contains links to these domains. Also see Links.

Domain
nigga.okta.com
www.okta.com
Subject Issuer Validity Valid
roblox-hrs.com
R3		 2024-01-27 -
2024-04-26		 3 months crt.sh
*.oktacdn.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-12-15 -
2025-01-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://rbxhr.net/
Frame ID: 4DB2A5A0E57C7023FBBD8D094E96A4C1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign In

Page URL History Show full URLs

  1. http://rbxhr.net/ HTTP 301
    https://rbxhr.net/ Page URL

Page Statistics

10
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

681 kB
Transfer

2215 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://rbxhr.net/ HTTP 301
    https://rbxhr.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
rbxhr.net/
Redirect Chain
  • http://rbxhr.net/
  • https://rbxhr.net/
10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rbxhr.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.76.65.42 Los Angeles, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
45.76.65.42.vultrusercontent.com
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
ec135f1787eab66ac1d25941a22b452785c1d9a1ac3bc6f69e4102e923bdf867

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
3174
Content-Type
text/html
Date
Sat, 27 Jan 2024 05:12:46 GMT
ETag
"29af-60fde8f900280-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Fri, 26 Jan 2024 19:47:06 GMT
Server
Apache/2.4.52 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
301
Content-Type
text/html; charset=iso-8859-1
Date
Sat, 27 Jan 2024 05:12:46 GMT
Keep-Alive
timeout=5, max=100
Location
https://rbxhr.net/
Server
Apache/2.4.52 (Ubuntu)
okta-sign-in.min.js
ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/ 		2 MB
477 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/okta-sign-in.min.js
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:14 GMT
x-amz-meta-sha1sum
0ebce80c1902181c4eeac9cb6c3cd229f44cadde
content-encoding
gzip
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
725973
x-cache
Hit from cloudfront
last-modified
Mon, 25 Sep 2023 22:41:04 GMT
server
nginx
etag
W/"b065fc11fb7d64a21c36a93e2b9a4c7a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id
ODcsegcPiI3oWfEPIRcR5Vd76E7VEhIuYIWHk1oXM_nOdXqiYbrUqQ==
expires
Fri, 17 Jan 2025 19:33:14 GMT
okta-sign-in.min.css
ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/ 		217 KB
37 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
31ec6b02dfe1de9903c0688f4dc9d33bcf49d6fff8003da7a74c3d30b38f13f9
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:13 GMT
x-amz-meta-sha1sum
d05ffdde7a9f1a519770c8209de521a2a4fff863
content-encoding
gzip
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
725973
x-cache
Hit from cloudfront
last-modified
Mon, 25 Sep 2023 22:39:52 GMT
server
nginx
etag
W/"bb726b407a54ee7d118fbfaf8b302895"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id
A_-RpT2oeL5V6rvDNm_OcCJmJulqGlE5qebjrBjxG-4BSyo5HgfkrQ==
expires
Fri, 17 Jan 2025 19:33:13 GMT
loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css
ok1static.oktacdn.com/assets/loginpage/css/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/loginpage/css/loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:14 GMT
x-amz-meta-sha1sum
db76514c4942184db3baedf6ac119ff9538368fc
content-encoding
gzip
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
725973
x-cache
Hit from cloudfront
last-modified
Tue, 07 Feb 2023 00:39:41 GMT
server
nginx
etag
W/"c1227d73b70be13e51aae80fe238b0ae"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id
y4zvT1nIqV610hVp6TlX7NJOY0HZ9V542Y9fEyBjybz2PZYlanWwGg==
expires
Fri, 17 Jan 2025 19:33:14 GMT
style-sheet
rbxhr.net/api/internal/brand/theme/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rbxhr.net/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.76.65.42 Los Angeles, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
45.76.65.42.vultrusercontent.com
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Sat, 27 Jan 2024 05:12:47 GMT
Server
Apache/2.4.52 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
272
Content-Type
text/html; charset=iso-8859-1
initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js
ok1static.oktacdn.com/assets/js/mvc/loginpage/ 		204 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
bb7b04fe7a146c5260e3f1a82db4c675c3d41f53f0fe4fb7517840cef54f2b0b
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

Referer
https://rbxhr.net/
Origin
https://rbxhr.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:14 GMT
x-amz-meta-sha1sum
34f075e4d0f6b20eb712a2053d423869bb60771b
content-encoding
gzip
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
725973
x-cache
Hit from cloudfront
last-modified
Mon, 10 Jul 2023 22:04:34 GMT
server
nginx
etag
W/"d05a8c2e6bdf6d212b92af4d6b9cfefe"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id
4AiwAqMUbCPP0y6c1LmLEOvngRrjsxMCcHNv3FFHe6KX3SvEjyV34g==
expires
Fri, 17 Jan 2025 19:33:14 GMT
fs01psph4hbqCA0SS0h8
ok1static.oktacdn.com/fs/bco/1/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ok1static.oktacdn.com/fs/bco/1/fs01psph4hbqCA0SS0h8
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
94fbcacaceab869fe798b45020e8e8e663d2be5d121e79c787c8a74188b5f49b
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 06 Jan 2024 15:40:23 GMT
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
1776744
x-cache
Hit from cloudfront
content-length
7967
last-modified
Tue, 13 Sep 2022 19:43:15 GMT
server
nginx
etag
"86307eab776b4a07db6b53f758e79f5d"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
x-amz-cf-id
CyKGhlTvVAlC1orhAfe7VTc0qREndY8tvNIRsp_DVYvMiESvCsWuNg==
expires
Sun, 05 Jan 2025 15:40:23 GMT
fs01hv78yp8ry6f1K0h8
ok1static.oktacdn.com/fs/bco/7/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ok1static.oktacdn.com/fs/bco/7/fs01hv78yp8ry6f1K0h8
Requested by
Host: rbxhr.net
URL: https://rbxhr.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
f1b3f81d406b41745cc9c2360632f3c20a815b33e2da61adffdb75092985d816
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://rbxhr.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 06 Jan 2024 20:17:54 GMT
strict-transport-security
max-age=315360000; includeSubDomains
via
1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
1760093
x-cache
Hit from cloudfront
content-length
32390
last-modified
Wed, 04 Dec 2019 23:44:21 GMT
server
nginx
etag
"01c0d4b7d21676d5a92877f0a3a32a70"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
x-amz-cf-id
6X8y4a_ivaaa8M3tPlKMWVLFqxMy8XBDWdKVYeZM2ykjINTPZWK5Nw==
expires
Sun, 05 Jan 2025 20:17:54 GMT
montserrat-okta-light-webfont.woff
ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-light-webfont.woff
Requested by
Host: ok1static.oktacdn.com
URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

Referer
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css
Origin
https://rbxhr.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:15 GMT
x-amz-meta-sha1sum
3449db1ccdfe0aeaf89101cc28ecafaecae9fc89
via
1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
strict-transport-security
max-age=315360000; includeSubDomains
x-amz-cf-pop
FRA6-C1
age
725972
x-cache
Hit from cloudfront
content-length
22112
last-modified
Mon, 25 Sep 2023 22:39:54 GMT
server
nginx
etag
"6225f3ca44b83090833064727a09cc95"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
x-amz-cf-id
cdI0MYcjEFXhZGNCMqVCbJFAD7yXYlIm6umG4KSMbJc6E-RsjhPbkQ==
expires
Fri, 17 Jan 2025 19:33:15 GMT
montserrat-okta-regular-webfont.woff
ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-regular-webfont.woff
Requested by
Host: ok1static.oktacdn.com
URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-80.fra6.r.cloudfront.net
Software
nginx /
Resource Hash
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

Referer
https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css
Origin
https://rbxhr.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 19:33:15 GMT
x-amz-meta-sha1sum
b838e30072520735c49eda52cb2d3a0f4b30f0f2
via
1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
strict-transport-security
max-age=315360000; includeSubDomains
x-amz-cf-pop
FRA6-C1
age
725972
x-cache
Hit from cloudfront
content-length
21980
last-modified
Mon, 25 Sep 2023 22:39:54 GMT
server
nginx
etag
"8f2822b73b5f9c106c6f2e0db820bcbb"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
x-amz-cf-id
MkL0TuOfjkPmBSf_x8p3aGkBCMvO50kF_xEMZlmK8mqrOJR_Zobv8A==
expires
Fri, 17 Jan 2025 19:33:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Roblox (Gaming)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| cspNonce object| regeneratorRuntime function| jQueryCourage object| u2f function| OktaSignIn object| okta object| OktaLogin object| jQBrowser

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://rbxhr.net/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)