ww25.roblox.li
Open in
urlscan Pro
199.59.243.223
Public Scan
Effective URL: http://ww25.roblox.li/?subid1=20230329-1126-350c-84ac-5159dde901c1
Submission Tags: phishingrod
Submission: On March 29 via api from DE — Scanned from AU
Summary
This is the only time ww25.roblox.li was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 103.224.182.250 103.224.182.250 | 133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited) | |
5 | 199.59.243.223 199.59.243.223 | 16509 (AMAZON-02) (AMAZON-02) | |
1 7 | 74.125.68.104 74.125.68.104 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.4.157 142.250.4.157 | 15169 (GOOGLE) (GOOGLE) | |
4 | 74.125.24.94 74.125.24.94 | 15169 (GOOGLE) (GOOGLE) | |
19 | 5 |
ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: lb-182-250.above.com
roblox.li |
ASN15169 (GOOGLE, US)
PTR: sm-in-f157.1e100.net
partner.googleadservices.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
88 KB |
6 |
roblox.li
1 redirects
roblox.li ww25.roblox.li |
27 KB |
4 |
gstatic.com
www.gstatic.com fonts.gstatic.com Failed |
351 KB |
1 |
googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 886 |
591 B |
19 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.google.com |
1 redirects
ww25.roblox.li
www.google.com www.gstatic.com |
5 | ww25.roblox.li |
ww25.roblox.li
|
4 | www.gstatic.com |
www.google.com
www.gstatic.com |
1 | partner.googleadservices.com |
www.google.com
|
1 | roblox.li | 1 redirects |
0 | fonts.gstatic.com Failed |
www.google.com
|
19 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
http://ww25.roblox.li/?subid1=20230329-1126-350c-84ac-5159dde901c1
Frame ID: 0B6F25226D8761F8A21B4BFAFD65B9EA
Requests: 7 HTTP requests in this frame
Frame:
https://www.google.com/sorry/index?continue=https://www.google.com/afs/ads%3Fadtest%3Doff%26psid%3D6726908358%26pcsa%3Dfalse%26channel%3Dpid-bodis-gcontrol36%252Cpid-bodis-gcontrol97%252Cpid-bodis-gcontrol300%252Cpid-bodis-gcontrol152%252Cpid-bodis-gcontrol401%26client%3Ddp-bodis30_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fww25.roblox.li%253Fcaf%2526subid1%253D20230329-1126-350c-84ac-5159dde901c1%26max_radlink_len%3D50%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2634842340955138%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%26format%3Dr3%26nocache%3D5301680049597126%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww25.roblox.li%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D2%26u_tz%3D0%26dt%3D1680049597127%26u_w%3D1600%26u_h%3D1200%26biw%3D1600%26bih%3D1200%26psw%3D1584%26psh%3D76%26frm%3D0%26cl%3D518347065%26uio%3D-%26cont%3Drs%26jsid%3Dcaf%26jsv%3D518347065%26rurl%3Dhttp%253A%252F%252Fww25.roblox.li%252F%253Fsubid1%253D20230329-1126-350c-84ac-5159dde901c1%26adbw%3Dmaster-1%253A1584&hl=en&q=EgSt9dF7GL2LjqEGIjCbIpbyJf4dzCTAneCV2zkKTt4yl4iHPxood2KXE49wdsVFNoHvDVLUSC5hbPZKKa0yAXI
Frame ID: E273A867AAE35AD0FDBFD98A75D5F81B
Requests: 3 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=vpEprwpCoBMgy-fvZET0Mz6L&size=normal&s=Br4YzROMv4AHEFrlB60TJdBRcrMNDASfMaW9GIHp5gjzYEItzfIn-NNZHG3QM54yOE_od0pLWPBt2GyXzPwt_-ND9iKGuTZMETrIGBOUC7-o_Kgn4ENDh0L6cLQLxsZduqt2Hjy414zTbmbULwr47GUPV-eVNZngYmJy_f-XsO7YTP0oGZVGXQvR4L7ctsHkyPF-qIxEkPcZHeFqPZl60zQm_OxEuTdynLqwAN5sUboCyL0WG0s4PgdFH3jJF2R2Y8K0RUoSePW7wEng46tMbF-K05Bcfl8&cb=mm600ck3ms8
Frame ID: 55081141EA83673EA328DE30F671482D
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=vpEprwpCoBMgy-fvZET0Mz6L&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b
Frame ID: CA270F258460FBB5939F0F150C7C6150
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Roblox.liPage URL History Show full URLs
-
https://roblox.li/
HTTP 302
http://ww25.roblox.li/?subid1=20230329-1126-350c-84ac-5159dde901c1 Page URL
Detected technologies
reCAPTCHA (Captchas) ExpandDetected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://roblox.li/
HTTP 302
http://ww25.roblox.li/?subid1=20230329-1126-350c-84ac-5159dde901c1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://www.google.com/afs/ads?adtest=off&psid=6726908358&pcsa=false&channel=pid-bodis-gcontrol36%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol300%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol401&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.roblox.li%3Fcaf%26subid1%3D20230329-1126-350c-84ac-5159dde901c1&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2634842340955138&oe=UTF-8&ie=UTF-8&fexp=21404&format=r3&nocache=5301680049597126&num=0&output=afd_ads&domain_name=ww25.roblox.li&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1680049597127&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1584&psh=76&frm=0&cl=518347065&uio=-&cont=rs&jsid=caf&jsv=518347065&rurl=http%3A%2F%2Fww25.roblox.li%2F%3Fsubid1%3D20230329-1126-350c-84ac-5159dde901c1&adbw=master-1%3A1584 HTTP 302
- https://www.google.com/sorry/index?continue=https://www.google.com/afs/ads%3Fadtest%3Doff%26psid%3D6726908358%26pcsa%3Dfalse%26channel%3Dpid-bodis-gcontrol36%252Cpid-bodis-gcontrol97%252Cpid-bodis-gcontrol300%252Cpid-bodis-gcontrol152%252Cpid-bodis-gcontrol401%26client%3Ddp-bodis30_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fww25.roblox.li%253Fcaf%2526subid1%253D20230329-1126-350c-84ac-5159dde901c1%26max_radlink_len%3D50%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2634842340955138%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%26format%3Dr3%26nocache%3D5301680049597126%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww25.roblox.li%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D2%26u_tz%3D0%26dt%3D1680049597127%26u_w%3D1600%26u_h%3D1200%26biw%3D1600%26bih%3D1200%26psw%3D1584%26psh%3D76%26frm%3D0%26cl%3D518347065%26uio%3D-%26cont%3Drs%26jsid%3Dcaf%26jsv%3D518347065%26rurl%3Dhttp%253A%252F%252Fww25.roblox.li%252F%253Fsubid1%253D20230329-1126-350c-84ac-5159dde901c1%26adbw%3Dmaster-1%253A1584&hl=en&q=EgSt9dF7GL2LjqEGIjCbIpbyJf4dzCTAneCV2zkKTt4yl4iHPxood2KXE49wdsVFNoHvDVLUSC5hbPZKKa0yAXI
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ww25.roblox.li/ Redirect Chain
|
971 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
parking.2.104.0.js
ww25.roblox.li/js/ |
67 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
_fd
ww25.roblox.li/ |
4 KB 3 KB |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
caf.js
www.google.com/adsense/domains/ |
145 KB 53 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
px.gif
ww25.roblox.li/ |
42 B 421 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
px.gif
ww25.roblox.li/ |
42 B 421 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie.js
partner.googleadservices.com/gampad/ |
358 B 591 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index
www.google.com/sorry/ Frame E273 Redirect Chain
|
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ Frame E273 |
850 B 577 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/ Frame E273 |
405 KB 163 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 5508 |
48 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/ Frame 5508 |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/ Frame 5508 |
405 KB 162 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 5508 |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 5508 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 5508 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5508 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame 5508 |
102 B 134 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame CA27 |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/ Frame CA27 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/ Frame CA27 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- fonts.gstatic.com
- URL
- https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
- Domain
- www.gstatic.com
- URL
- https://www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/styles__ltr.css
- Domain
- www.gstatic.com
- URL
- https://www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/recaptcha__en.js
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless string| park object| regeneratorRuntime function| setImmediate function| clearImmediate number| googleNDT_ number| googleAltLoader object| google function| __sasCookie3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
roblox.li/ | Name: __tad Value: 1680049595.1543082 |
|
ww25.roblox.li/ | Name: parking_session Value: 45d33d15-2f78-f136-b896-d0b99f83067a |
|
.roblox.li/ | Name: __gsas Value: ID=55c998b6e92a9c57:T=1680049597:S=ALNI_MbC0JqZTnUozUkBIoftl7aSoVJKBg |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
partner.googleadservices.com
roblox.li
ww25.roblox.li
www.google.com
www.gstatic.com
fonts.gstatic.com
www.gstatic.com
103.224.182.250
142.250.4.157
199.59.243.223
74.125.24.94
74.125.68.104
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0db8cc43fad09f7f02e6eac5db2cce50f60bfe302937367e683a29c6a6756a6e
194cd67593bd2cc9a679870f49a6ede2d71f884de88e6f799abbce040c4d7a47
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1f33c43285e331e2acc0e60c7920e90f66f1209c48cc82ed77578b0c9cde1bb2
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
739b23a716eadc71314cf985144e704e215244645eca8ce57678363073522997
7d2c1727a32a92776f9a3078abb845bbeb77e6603c40a318f12ea1e1b5a040d7
92f0834f8945ee4e460248522995a530339ae6ed188b5fa20920536188c89ec2
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
a05f6a0d61a61033aa26940091782b3be79ca74c36c611c561f7ceae816b4837
a22e425317dd9d6bb2bcc724ec7179d54c747165c9143505d7a129ad7a549da7
d5cc3df90e96c9f3726603619257418f67bdbe309e9aa8f4d9e12779028b20c7
dd0d37adeb04b70c9c1a685f30233486fdad2136cf54cca03862eef582d8367b
df656d0490300ae7f9ed9c6a7f4664d7d202f0e048108a9e93445363de65f6b2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629