www.roblox-account-free.greentips.uk Open in urlscan Pro
35.206.98.56  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.roblox-account-free.greentips.uk/	1 KB 1 KB	791ms 169ms	Document text/html	35.206.98.56 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://www.roblox-account-free.greentips.uk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.206.98.56 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 56.98.206.35.bc.googleusercontent.com Software nginx / Resource Hash 1fa0ec95fc06f4e03e1121497d80b0ea27bb17e9f8ef5cc7abd5cb221721ed55 Request headers :method GET :authority www.roblox-account-free.greentips.uk :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server nginx date Tue, 26 May 2020 23:41:37 GMT content-type text/html vary Accept-Encoding last-modified Tue, 26 May 2020 22:11:50 GMT etag W/"5d8-5a69461d58801" x-httpd 1 host-header 192fc2e7e50945beb8231a492d6a8024 x-proxy-cache MISS x-proxy-cache-info D NC:000000 UP:0 content-encoding gzip
GET H2	200	locker.js Show response cpabuild.com/public/external/	22 KB 6 KB	72ms 29ms	Script application/javascript	2606:4700:20::681a:daf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cpabuild.com/public/external/locker.js Requested by Host: www.roblox-account-free.greentips.uk URL: https://www.roblox-account-free.greentips.uk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:daf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a6e8d166b5ad43c05334f28d92b9679349171e628266016553563f0246a20297 Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:37 GMT content-encoding br cf-cache-status HIT last-modified Tue, 21 Apr 2020 07:30:59 GMT server cloudflare age 4581 etag W/"57ac-5a3c7ff349b02" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=691200 cf-ray 599b5913bbdec295-FRA cf-request-id 02f4f600560000c295bab38200000001
GET H2	200	html.890750.7501a.0.js Show response cldoffers.net/public/external/v2/	8 KB 2 KB	64ms 16ms	Script application/javascript	2606:4700:e2::ac40:8b16 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cldoffers.net/public/external/v2/html.890750.7501a.0.js Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.28 Resource Hash 6e0c321ff36ad052800f2f2531583d771e72fba3df26fcbc6bf4b06e7d8e2d6a Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:37 GMT content-encoding br cf-cache-status HIT server cloudflare age 6649 x-powered-by PHP/7.2.28 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 599b591449b1d6d9-FRA cf-request-id 02f4f600ad0000d6d9d6adf200000001
GET H2	200	css_front.css cldoffers.net/public/external/	6 KB 2 KB	62ms 14ms	Stylesheet text/css	2606:4700:e2::ac40:8b16 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cldoffers.net/public/external/css_front.css Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:37 GMT content-encoding br cf-cache-status HIT last-modified Fri, 10 Apr 2020 22:28:56 GMT server cloudflare age 4443 etag W/"19c4-5a2f742516a35" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 599b591449aed6d9-FRA cf-request-id 02f4f600ad0000d6d9d6ade200000001
GET H2	200	giphy.gif media.giphy.com/media/TFaSUeovYpleP6l8xK/	4 MB 4 MB	393ms 132ms	Image image/gif	151.101.38.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://media.giphy.com/media/TFaSUeovYpleP6l8xK/giphy.gif Requested by Host: www.roblox-account-free.greentips.uk URL: https://www.roblox-account-free.greentips.uk/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.38.2 Amsterdam, Netherlands, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 78498a4515b7a95a0932c2d8c5904cf0ba90acf31b51c47fa6eb34938f63f41b Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:37 GMT via 1.1 varnish, 1.1 varnish last-modified Thu, 23 Jan 2020 19:09:25 GMT age 1363146 etag "059cb92561a01ceddd7326e905c26b4f" x-served-by cache-bwi5142-BWI, cache-ams21075-AMS status 200 x-cache HIT, HIT content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-timer S1590536498.647153,VS0,VE0 content-length 4273962 x-cache-hits 1, 1
GET H2	200	css.css cldoffers.net/public/clockers/PrimeApps/	1010 B 420 B	11ms 10ms	Stylesheet text/css	2606:4700:e2::ac40:8b16 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cldoffers.net/public/clockers/PrimeApps/css.css Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:37 GMT content-encoding br cf-cache-status HIT last-modified Fri, 10 Apr 2020 22:29:00 GMT server cloudflare age 3795 etag W/"3f2-5a2f7428ae907" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 599b591469dbd6d9-FRA cf-request-id 02f4f600bf0000d6d9d6ae0200000001
GET H2	200	check.php Show response cldoffers.net/public/external/	0 202 B	333ms 332ms	Script application/javascript	2606:4700:e2::ac40:8b16 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cldoffers.net/public/external/check.php?time=1590536499343&it=890750 Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.28 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.roblox-account-free.greentips.uk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 26 May 2020 23:41:39 GMT cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.28 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type application/javascript status 200 cf-ray 599b5920ef71d6d9-FRA content-length 0 cf-request-id 02f4f608910000d6d9d6b3b200000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cldoffers.net
cpabuild.com
media.giphy.com
www.roblox-account-free.greentips.uk
151.101.38.2
2606:4700:20::681a:daf
2606:4700:e2::ac40:8b16
35.206.98.56
1fa0ec95fc06f4e03e1121497d80b0ea27bb17e9f8ef5cc7abd5cb221721ed55
6e0c321ff36ad052800f2f2531583d771e72fba3df26fcbc6bf4b06e7d8e2d6a
78498a4515b7a95a0932c2d8c5904cf0ba90acf31b51c47fa6eb34938f63f41b
a6e8d166b5ad43c05334f28d92b9679349171e628266016553563f0246a20297
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855