![](/screenshots/75e74817-2eac-464d-8378-dd19209a6897.png)
rbx.oktapreview.com
Open in
urlscan Pro
3.33.147.176
Public Scan
Effective URL: https://rbx.oktapreview.com/app/zendesk/exk194ziusi00vxPd0h8/sso/saml?RelayState=https%3A%2F%2Fvngroblox.zendesk.com%2F&bran...
Submission Tags: phishingrod
Submission: On June 12 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on January 9th 2024. Valid for: a year.
This is the only time rbx.oktapreview.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 4 | 104.16.51.111 104.16.51.111 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 104.18.72.113 104.18.72.113 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 3 | 104.16.53.111 104.16.53.111 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 3.33.147.176 3.33.147.176 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 18.244.18.4 18.244.18.4 | 16509 (AMAZON-02) (AMAZON-02) | |
12 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ab7bfd6a9b7fa1eec.awsglobalaccelerator.com
rbx.oktapreview.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-4.fra56.r.cloudfront.net
op1static.oktacdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
zendesk.com
5 redirects
vngroblox.zendesk.com roblox1531333111.zendesk.com |
13 KB |
5 |
zdassets.com
static.zdassets.com — Cisco Umbrella Rank: 2343 |
46 KB |
3 |
oktapreview.com
rbx.oktapreview.com |
8 KB |
1 |
oktacdn.com
op1static.oktacdn.com — Cisco Umbrella Rank: 59764 |
4 KB |
12 | 4 |
Domain | Requested by | |
---|---|---|
5 | static.zdassets.com |
vngroblox.zendesk.com
|
4 | vngroblox.zendesk.com |
2 redirects
vngroblox.zendesk.com
|
3 | rbx.oktapreview.com |
static.zdassets.com
rbx.oktapreview.com |
3 | roblox1531333111.zendesk.com | 3 redirects |
1 | op1static.oktacdn.com |
rbx.oktapreview.com
|
12 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vngroblox.zendesk.com E5 |
2024-06-12 - 2024-09-10 |
3 months | crt.sh |
zdassets.com E1 |
2024-05-01 - 2024-07-30 |
3 months | crt.sh |
*.oktapreview.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-01-09 - 2025-02-08 |
a year | crt.sh |
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-12-15 - 2025-01-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://rbx.oktapreview.com/app/zendesk/exk194ziusi00vxPd0h8/sso/saml?RelayState=https%3A%2F%2Fvngroblox.zendesk.com%2F&brand_id=23743807129364&SAMLRequest=fZFLT8MwEITv%2FRWR707ivFqsJlXUCilSQagFDtwcZ6tG%2BFG8Tin8etQAUjnQ%0A6%2B58mtnZ%2BeKkVXAEh701JWFhTBbVZI5CqwOvB783G3gbAH1w0sogHxclGZzh%0AVmCP3AgNyL3k2%2FpuzZMw5gdnvZVWkQvkOiEQwfneGhI0q5KcAUenN7sZK9qW%0Atq2c0SyXOW0L0dGMdTnkO9m2siBBgzhAY9AL40uSxElG44Ky5DGe8jzj6fSF%0ABM%2B%2F1yVhTIL612xpDQ4a3BbcsZfwtFmXZO%2F9AXkUOdsqe2J5ytI0ZYyFn2A6%0AwNdQWh0JKQExOsck1VgVH2O46ho2jy6VPw3fCw3N6sGqXn4EtVL2felAeCiJ%0AdwOQ4NY6Lfz%2F7bGQjZO%2Bo7tRykGLXtVd5wCRRNW3699XVpMv%0A
Frame ID: AA13A4E2544F73115091E9FE11000244
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/75e74817-2eac-464d-8378-dd19209a6897.png)
Page Title
Roblox - Zugriff verbotenPage URL History Show full URLs
-
https://vngroblox.zendesk.com/
HTTP 301
https://vngroblox.zendesk.com/access HTTP 302
https://vngroblox.zendesk.com/access/unauthenticated Page URL
-
https://roblox1531333111.zendesk.com/auth/v2/login/signin?return_to=https%3A%2F%2Fvngroblox.zendesk.com%2F&theme=...
HTTP 302
https://roblox1531333111.zendesk.com/auth/v2/login/expanded_sso_options?auth_origin=23743807129364%2Cfalse%2Ctrue... HTTP 302
https://roblox1531333111.zendesk.com/auth/v2/login/continue_with_sso_tracking?auth_origin=23743807129364%2Cfalse%... HTTP 302
https://rbx.oktapreview.com/app/zendesk/exk194ziusi00vxPd0h8/sso/saml?RelayState=https%3A%2F%2Fvngroblox... Page URL
Detected technologies
![](/vendor/wappa/icons/Zendesk.png)
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://vngroblox.zendesk.com/
HTTP 301
https://vngroblox.zendesk.com/access HTTP 302
https://vngroblox.zendesk.com/access/unauthenticated Page URL
-
https://roblox1531333111.zendesk.com/auth/v2/login/signin?return_to=https%3A%2F%2Fvngroblox.zendesk.com%2F&theme=hc&locale=8&brand_id=23743807129364&auth_origin=23743807129364%2Cfalse%2Ctrue
HTTP 302
https://roblox1531333111.zendesk.com/auth/v2/login/expanded_sso_options?auth_origin=23743807129364%2Cfalse%2Ctrue&brand_id=23743807129364&locale=8&return_to=https%3A%2F%2Fvngroblox.zendesk.com%2F&theme=hc HTTP 302
https://roblox1531333111.zendesk.com/auth/v2/login/continue_with_sso_tracking?auth_origin=23743807129364%2Cfalse%2Ctrue&brand_id=23743807129364&locale=8&remote_auth_id=360000005723&return_to=https%3A%2F%2Fvngroblox.zendesk.com%2F&theme=hc HTTP 302
https://rbx.oktapreview.com/app/zendesk/exk194ziusi00vxPd0h8/sso/saml?RelayState=https%3A%2F%2Fvngroblox.zendesk.com%2F&brand_id=23743807129364&SAMLRequest=fZFLT8MwEITv%2FRWR707ivFqsJlXUCilSQagFDtwcZ6tG%2BFG8Tin8etQAUjnQ%0A6%2B58mtnZ%2BeKkVXAEh701JWFhTBbVZI5CqwOvB783G3gbAH1w0sogHxclGZzh%0AVmCP3AgNyL3k2%2FpuzZMw5gdnvZVWkQvkOiEQwfneGhI0q5KcAUenN7sZK9qW%0Atq2c0SyXOW0L0dGMdTnkO9m2siBBgzhAY9AL40uSxElG44Ky5DGe8jzj6fSF%0ABM%2B%2F1yVhTIL612xpDQ4a3BbcsZfwtFmXZO%2F9AXkUOdsqe2J5ytI0ZYyFn2A6%0AwNdQWh0JKQExOsck1VgVH2O46ho2jy6VPw3fCw3N6sGqXn4EtVL2felAeCiJ%0AdwOQ4NY6Lfz%2F7bGQjZO%2Bo7tRykGLXtVd5wCRRNW3699XVpMv%0A Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://vngroblox.zendesk.com/ HTTP 301
- https://vngroblox.zendesk.com/access HTTP 302
- https://vngroblox.zendesk.com/access/unauthenticated
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
unauthenticated
vngroblox.zendesk.com/access/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
help_center-01613cfa8ea04b91e64cb68eaba4d178023f84157cf82c6351454392094ae911.css
static.zdassets.com/classic/assets/application/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min-a6ed45d15e46615f8c15931ca254e398a912e770b10122a4435529a1a523180d.js
static.zdassets.com/classic/assets/vendor/ |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Placeholders-4ebb1ef271cbf42b78c665e66370fb891a420980a0eea3070ef06baac07b6113.js
static.zdassets.com/classic/assets/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
help_center-f268a8fec31526a52d94b1a9451075f5d0e4e14fb1e30a19d9a29f9d92c70880.js
static.zdassets.com/classic/assets/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo
vngroblox.zendesk.com/hc/ |
5 KB 5 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
host-without-iframe.js
static.zdassets.com/auth/89db87fa5856fd9ca1254fa82921aa9d71d02833/v2/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
saml
rbx.oktapreview.com/app/zendesk/exk194ziusi00vxPd0h8/sso/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
errors-v2.css
rbx.oktapreview.com/assets/css/sections/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
style-sheet
rbx.oktapreview.com/api/internal/brand/theme/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
okta-logo.1e146cad5713da744492be95eb0f7793.png
op1static.oktacdn.com/assets/img/logos/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
rbx.oktapreview.com/ |
5 KB 6 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- rbx.oktapreview.com
- URL
- https://rbx.oktapreview.com/api/internal/brand/theme/style-sheet?touch-point=ERROR_PAGE&v=1c5f33b32b86a6a64df6637d07c27a375119d7a8fe54632d87e9ed00b24d9510bd977fcafd928c2991cd5c2dae06d79c
Verdicts & Comments Add Verdict or Comment
0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vngroblox.zendesk.com/ | Name: _zendesk_shared_session Value: -S1l5STUxb3NlaGlLMmtGWTVqaXlMbktEQnlOb0wxbC9OUGRGcGxyL3RQVmJMQmpOSDdldkdNR0o5d0Q4VmxsNVVNRXZKd3NjdW0rRjBRcys5NUdtQ1l4d3JkMEdrQzYwZHdPTzZ6ZDZzbWlkc3I0emdBek41bkNPVHRhN3RBcHRSQkQxZ296THNFdTVWbkNzdStHdG9RPT0tLVl0dDZkNW5ldHo2a053RFRSTURjWnc9PQ%3D%3D--31f4804241a7ea2321abeec01b5959b2289f1f54 |
|
.vngroblox.zendesk.com/ | Name: __cfruid Value: 29b2a04d3de4ede52dc27441b63d7b2408c1ba77-1718178875 |
|
vngroblox.zendesk.com/ | Name: _zendesk_session Value: zqrdDqlHRoGLPikO2PS1mqsXsW7gH73Yr9fVUARnyKEdMwoB%2FN3oRfWiD3RYv5FMdWd7SYaF%2BNqtj2V3grhf7CzBnjVwtvEFfpuLzwXtH1LvKsLDTFRMa49oVL0h3qOTHME%2BCWIxifF%2BrOgbGKxZJDsMfW7OwiDmU3gzitvu51SMqjOWRn%2F%2Bhm6W%2F%2Bu8enAXAM47vqhB6XqehGKqtaYMle%2BL0zlH3zQM%2BMXRPwul33pOmAP1EVo528vo0wnp24uOQmpa6VBQFPiMK0tKtE%2Ba9266G2JhrMvrxtcABnBWnoygLi3l4siW%2FUZgFFiz9%2FJs4G8bdSmLSxxB8eUsPJ1qH7wfysedSTUELplNN97juxdBHaOQORDxXH3B60yYlBlvilc%2FNYRkpNXCHu21%2Bdf5%2BW1odgOftVab--KRdoI2mUr2dP8A32--wVOM5BnCD3zvp2wilMWVxg%3D%3D |
|
roblox1531333111.zendesk.com/ | Name: _zendesk_shared_session Value: -c1NPNEZ3ZWc1YzhlQUZBUm92ODRrUytpS3VGRm1wdkpyd1RXaGdVVVVvdWpPRVRzNDMrbE12ZFdlQTc1VVBGbWo4QllwcE1PSWhBeWxUU1QyVGM5MFNOUXFwdWxXMERZRURtTEo5Um9iTktTU01YVnVUSkRNNlpHa0prRUg4Vm9SSm5SS3FWOG9BeTJ6am5uSy9SQWpBPT0tLWR6UGFOZVNHbzdOSUdQbXV1VlFpR0E9PQ%3D%3D--82391d75da8dbd8087d4925783f4b91217461803 |
|
.roblox1531333111.zendesk.com/ | Name: __cfruid Value: 71efae1086385a45d329c5fbe2feded845a02f1e-1718178876 |
|
roblox1531333111.zendesk.com/ | Name: _zendesk_session Value: 9%2BTvxk%2BScOy2MPGfcj20kob%2BMONxoV1EP6%2B7UbjQnOHPenBXHbcRnaemWbC5IyW4rQ9S1fq%2FqRNhdAA955P9nbrQJx2wAf2WlzCsEjzzS2q4B4iLyY8S0sdcp9HIrHXtrVrX24xT0QLu%2F1QEYHEXFOtUqVSWZaxexBL6kwktlOjqVqpQdOhCJHTm16Ob4h8Cf8Atto3vFdh5R4%2FFRJZV1yR5RpUHfdAYNRZWM%2Bw4Mbvimm%2BsmW5HRRTvKLqRdg7jbWU8gb9yVxaDJ2CLqKXMqqFL8UrsDtK9hrmiK%2F9YdWFAeB5gZprLdZT0qOY%2BLm42bhHrDQkr30QcrMeq3c78y2OsngonC9sBL0B6CGQTukittrBXEJarA%2FvdHlQTbu7Y1YWipw%3D%3D--jfb3PL8z6yb1Fl1R--8an7erZM1S4Mgkm0ePndTg%3D%3D |
|
rbx.oktapreview.com/ | Name: JSESSIONID Value: 35483CFFE74A4696B44065FA4F3B9078 |
|
rbx.oktapreview.com/ | Name: t Value: default |
|
rbx.oktapreview.com/ | Name: DT Value: DI1Kxcsmnc3RqqhtaVRClqFug |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' ; |
Strict-Transport-Security | max-age=259200; includeSubDomains |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
op1static.oktacdn.com
rbx.oktapreview.com
roblox1531333111.zendesk.com
static.zdassets.com
vngroblox.zendesk.com
rbx.oktapreview.com
104.16.51.111
104.16.53.111
104.18.72.113
18.244.18.4
3.33.147.176
01613cfa8ea04b91e64cb68eaba4d178023f84157cf82c6351454392094ae911
07d7429f55979af1968161a3eb812a39c797f9c3e2f0fd88aecbf1ea741349c1
2b086a82df5a86d3b8c1210bc737e2f545134aed1262e20ef6ab8181a10a2597
4146f4c2384967dede1db1dae2da81c246d3d50228056bc0bb842e2ae868e13a
4ebb1ef271cbf42b78c665e66370fb891a420980a0eea3070ef06baac07b6113
815cb9a439421a1e917858677ddbe8896d1e3d020675f744d28c1044d310c5a5
9dac1e0b81e6bfd430c7243bcfc30c0e0504c6ea5fa8a9a82d3c9e3bd62eb9a8
a6ed45d15e46615f8c15931ca254e398a912e770b10122a4435529a1a523180d
f268a8fec31526a52d94b1a9451075f5d0e4e14fb1e30a19d9a29f9d92c70880
f9e86fb363a05f75ab3b525439d46bf4911d4cd4ae94c656c0198206374002aa