www.roblox-account-free.greentips.uk Open in urlscan Pro
35.206.98.56  Malicious Activity! Public Scan

URL: https://www.roblox-account-free.greentips.uk/
Submission Tags: @jcybersec_
Submission: On May 26 via api from GB

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 35.206.98.56, located in Mountain View, United States and belongs to GOOGLE-2, US. The main domain is www.roblox-account-free.greentips.uk.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 26th 2020. Valid for: 3 months.
This is the only time www.roblox-account-free.greentips.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 35.206.98.56 19527 (GOOGLE-2)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 2606:4700:e2:... 13335 (CLOUDFLAR...)
1 151.101.38.2 54113 (FASTLY)
7 4
Domain Requested by
4 cldoffers.net cpabuild.com
1 media.giphy.com www.roblox-account-free.greentips.uk
1 cpabuild.com www.roblox-account-free.greentips.uk
1 www.roblox-account-free.greentips.uk
7 4

This site contains no links.

Subject Issuer Validity Valid
roblox-account-free.greentips.uk
Let's Encrypt Authority X3
2020-05-26 -
2020-08-24
3 months crt.sh
cpabuild.com
CloudFlare Inc ECC CA-2
2019-11-09 -
2020-10-09
a year crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2020-04-21 -
2020-10-09
6 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2020-04-22 -
2021-04-23
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.roblox-account-free.greentips.uk/
Frame ID: 578183B856C58F947A9FA323D27DE826
Requests: 7 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

4188 kB
Transfer

4213 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.roblox-account-free.greentips.uk/
1 KB
1 KB
Document
General
Full URL
https://www.roblox-account-free.greentips.uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.206.98.56 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
56.98.206.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
1fa0ec95fc06f4e03e1121497d80b0ea27bb17e9f8ef5cc7abd5cb221721ed55

Request headers

:method
GET
:authority
www.roblox-account-free.greentips.uk
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
server
nginx
date
Tue, 26 May 2020 23:41:37 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Tue, 26 May 2020 22:11:50 GMT
etag
W/"5d8-5a69461d58801"
x-httpd
1
host-header
192fc2e7e50945beb8231a492d6a8024
x-proxy-cache
MISS
x-proxy-cache-info
D NC:000000 UP:0
content-encoding
gzip
locker.js
cpabuild.com/public/external/
22 KB
6 KB
Script
General
Full URL
https://cpabuild.com/public/external/locker.js
Requested by
Host: www.roblox-account-free.greentips.uk
URL: https://www.roblox-account-free.greentips.uk/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6e8d166b5ad43c05334f28d92b9679349171e628266016553563f0246a20297

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 21 Apr 2020 07:30:59 GMT
server
cloudflare
age
4581
etag
W/"57ac-5a3c7ff349b02"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=691200
cf-ray
599b5913bbdec295-FRA
cf-request-id
02f4f600560000c295bab38200000001
html.890750.7501a.0.js
cldoffers.net/public/external/v2/
8 KB
2 KB
Script
General
Full URL
https://cldoffers.net/public/external/v2/html.890750.7501a.0.js
Requested by
Host: cpabuild.com
URL: https://cpabuild.com/public/external/locker.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.2.28
Resource Hash
6e0c321ff36ad052800f2f2531583d771e72fba3df26fcbc6bf4b06e7d8e2d6a

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:37 GMT
content-encoding
br
cf-cache-status
HIT
server
cloudflare
age
6649
x-powered-by
PHP/7.2.28
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
599b591449b1d6d9-FRA
cf-request-id
02f4f600ad0000d6d9d6adf200000001
css_front.css
cldoffers.net/public/external/
6 KB
2 KB
Stylesheet
General
Full URL
https://cldoffers.net/public/external/css_front.css
Requested by
Host: cpabuild.com
URL: https://cpabuild.com/public/external/locker.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 10 Apr 2020 22:28:56 GMT
server
cloudflare
age
4443
etag
W/"19c4-5a2f742516a35"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
599b591449aed6d9-FRA
cf-request-id
02f4f600ad0000d6d9d6ade200000001
giphy.gif
media.giphy.com/media/TFaSUeovYpleP6l8xK/
4 MB
4 MB
Image
General
Full URL
https://media.giphy.com/media/TFaSUeovYpleP6l8xK/giphy.gif
Requested by
Host: www.roblox-account-free.greentips.uk
URL: https://www.roblox-account-free.greentips.uk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.38.2 Amsterdam, Netherlands, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
78498a4515b7a95a0932c2d8c5904cf0ba90acf31b51c47fa6eb34938f63f41b

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:37 GMT
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 23 Jan 2020 19:09:25 GMT
age
1363146
etag
"059cb92561a01ceddd7326e905c26b4f"
x-served-by
cache-bwi5142-BWI, cache-ams21075-AMS
status
200
x-cache
HIT, HIT
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-timer
S1590536498.647153,VS0,VE0
content-length
4273962
x-cache-hits
1, 1
css.css
cldoffers.net/public/clockers/PrimeApps/
1010 B
420 B
Stylesheet
General
Full URL
https://cldoffers.net/public/clockers/PrimeApps/css.css
Requested by
Host: cpabuild.com
URL: https://cpabuild.com/public/external/locker.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 10 Apr 2020 22:29:00 GMT
server
cloudflare
age
3795
etag
W/"3f2-5a2f7428ae907"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
599b591469dbd6d9-FRA
cf-request-id
02f4f600bf0000d6d9d6ae0200000001
check.php
cldoffers.net/public/external/
0
202 B
Script
General
Full URL
https://cldoffers.net/public/external/check.php?time=1590536499343&it=890750
Requested by
Host: cpabuild.com
URL: https://cpabuild.com/public/external/locker.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8b16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.2.28
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.roblox-account-free.greentips.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:41:39 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
PHP/7.2.28
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cf-ray
599b5920ef71d6d9-FRA
content-length
0
cf-request-id
02f4f608910000d6d9d6b3b200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker

0 Cookies