roblox-fr.site Open in urlscan Pro
45.130.41.101 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://roblox-fr.site/login.html
Submission Tags: @phish_report
Submission: On October 02 via api (October 2nd 2023, 7:31:51 pm UTC) from FI — Scanned from FR

Summary HTTP 1 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 45.130.41.101, located in St Petersburg, Russian Federation and belongs to BEGET-AS, RU. The main domain is roblox-fr.site.
TLS certificate: Issued by R3 on October 2nd 2023. Valid for: 3 months.

This is the only time roblox-fr.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Roblox (Gaming)

Domain & IP information

	IP Address		AS Autonomous System
1	45.130.41.101 45.130.41.101		198610 (BEGET-AS) (BEGET-AS)
1	2

1 45.130.41.101 (St Petersburg, Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: ssl.spore.beget.com

roblox-fr.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	roblox-fr.site roblox-fr.site	400 KB
1	1

	Domain	Requested by
1	roblox-fr.site
1	1

This site contains links to these domains. Also see Links.

Domain
www.roblox.com
create.roblox.com

Subject Issuer	Validity	Valid
roblox-fr.site R3	`2023-10-02` - `2023-12-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://roblox-fr.site/login.html
Frame ID: BAF4CABDE7A38C872923471F9D7A1873
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Roblox

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

571 kB
Transfer

1761 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.roblox.com/discover
Title: Discover

Search URL Search Domain Scan URL

URL: https://www.roblox.com/catalog
Title: Marketplace

Search URL Search Domain Scan URL

URL: https://www.roblox.com/develop
Title: Create

Search URL Search Domain Scan URL

URL: https://www.roblox.com/robux?ctx=nav
Title: 10% More Robux

Search URL Search Domain Scan URL

URL: https://www.roblox.com/discover/?Keyword=
Title: in Experiences

Search URL Search Domain Scan URL

URL: https://www.roblox.com/search/users?keyword=
Title: in People

Search URL Search Domain Scan URL

URL: https://www.roblox.com/catalog?CatalogContext=1&Keyword=
Title: in Marketplace

Search URL Search Domain Scan URL

URL: https://www.roblox.com/search/groups?keyword=
Title: in Groups

Search URL Search Domain Scan URL

URL: https://create.roblox.com/marketplace/models?keyword=
Title: in Creator Marketplace

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
11 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response roblox-fr.site/	2 MB 400 KB	474ms 142ms	Document text/html	45.130.41.101 BEGET-AS
General Check archive.org Show headers Download Go to Full URL https://roblox-fr.site/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.130.41.101 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU), Reverse DNS ssl.spore.beget.com Software nginx-reuseport/1.21.1 / Resource Hash `a76af143ebe8c54fcd597c59b23a32153238ea89b06fcf9c13e312249e578186` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers content-encoding gzip content-type text/html date Mon, 02 Oct 2023 19:31:45 GMT etag W/"1866cb-606bf6ca7956b" last-modified Mon, 02 Oct 2023 17:51:31 GMT server nginx-reuseport/1.21.1 vary Accept-Encoding
GET DATA	200 OK	truncated /	4 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9ac3dbbd74d9f0bb0a6b0aa4a0a6f155a2df9b1ab3d949130786c5b58b37eac7` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3f5cb5693554522cadf48baaee026b22d96d2b817353bb45d0412ec5b6494da` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `808595c0a58fdf98a2cafcb101a38698dacd129bc1483a33e2abca3112f9b3f7` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `02b72558241ed50cc7c169a216da04aecd0eff6d95aa134c105db6560273d90e` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	224 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8de8b83e652131a6dfa5e1d2a34324108c6e9eaebfd4f22d55508113f3c4ad2f` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	734 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `687755f1897a0fda138dbc84891aba126496395eecbb724b2165a7eaaac2c7a2` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	43 KB 43 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `252d971616775193836fe6c0c057edc13c511ed2bdbdb61fbe3c4567a3a8e530` Request headers Referer Origin https://roblox-fr.site accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	42 KB 42 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cafe3fe334035fb21ebef6484cfbe1efa85c46f02113c57f8047c875fb9928c5` Request headers Referer Origin https://roblox-fr.site accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	43 KB 43 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ecc55e4682a2b83956e183e86dc4d475e91bf192ea71faab52a8ed8cde83a3a3` Request headers Referer Origin https://roblox-fr.site accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	43 KB 43 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dee6942321440ad24c989d45fd96bf0c0c11e63e04357af2128118eb75eb887b` Request headers Referer Origin https://roblox-fr.site accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	10 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `abe5cc7ec81a92de937f9402e5c9b31a55f8d50e984e66a876e05d2d0603cfe3` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Roblox (Gaming)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

roblox-fr.site
45.130.41.101
02b72558241ed50cc7c169a216da04aecd0eff6d95aa134c105db6560273d90e
252d971616775193836fe6c0c057edc13c511ed2bdbdb61fbe3c4567a3a8e530
687755f1897a0fda138dbc84891aba126496395eecbb724b2165a7eaaac2c7a2
808595c0a58fdf98a2cafcb101a38698dacd129bc1483a33e2abca3112f9b3f7
8de8b83e652131a6dfa5e1d2a34324108c6e9eaebfd4f22d55508113f3c4ad2f
9ac3dbbd74d9f0bb0a6b0aa4a0a6f155a2df9b1ab3d949130786c5b58b37eac7
a76af143ebe8c54fcd597c59b23a32153238ea89b06fcf9c13e312249e578186
abe5cc7ec81a92de937f9402e5c9b31a55f8d50e984e66a876e05d2d0603cfe3
c3f5cb5693554522cadf48baaee026b22d96d2b817353bb45d0412ec5b6494da
cafe3fe334035fb21ebef6484cfbe1efa85c46f02113c57f8047c875fb9928c5
dee6942321440ad24c989d45fd96bf0c0c11e63e04357af2128118eb75eb887b
ecc55e4682a2b83956e183e86dc4d475e91bf192ea71faab52a8ed8cde83a3a3

roblox-fr.site Open in urlscan Pro 45.130.41.101 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

571 kBTransfer

1761 kBSize

0 Cookies

9 Outgoing links

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

roblox-fr.site Open in urlscan Pro
45.130.41.101 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

571 kB
Transfer

1761 kB
Size

0
Cookies

1 HTTP transactions
11 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!