![](/screenshots/fd09758b-8aa6-4718-b816-7b32ccb25ea7.png)
vvwvv-roblox-com.cf
Open in
urlscan Pro
35.186.245.55
Malicious Activity!
Public Scan
Submission Tags: https://sinking.yachts sinking-yachts phishing Search All
Submission: On March 14 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 27th 2022. Valid for: 3 months.
This is the only time vvwvv-roblox-com.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 2 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 35.186.245.55 35.186.245.55 | 15169 (GOOGLE) (GOOGLE) | |
1 7 | 20.212.178.58 20.212.178.58 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:82f::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 162.159.129.232 162.159.129.232 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:803::2003 | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
25 | 11 |
ASN15169 (GOOGLE, US)
PTR: 55.245.186.35.bc.googleusercontent.com
vvwvv-roblox-com.cf |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
gstatic.com
fonts.gstatic.com www.gstatic.com |
514 KB |
7 |
roblox.com.ms
1 redirects
www.roblox.com.ms |
23 KB |
4 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
24 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2181 |
83 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 ajax.googleapis.com — Cisco Umbrella Rank: 251 |
32 KB |
1 |
discordapp.net
media.discordapp.net — Cisco Umbrella Rank: 5320 |
91 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 403 |
19 KB |
1 |
vvwvv-roblox-com.cf
vvwvv-roblox-com.cf |
305 B |
25 | 8 |
Domain | Requested by | |
---|---|---|
7 | www.roblox.com.ms |
1 redirects
vvwvv-roblox-com.cf
www.roblox.com.ms |
6 | www.gstatic.com |
www.google.com
www.gstatic.com |
4 | www.google.com |
www.roblox.com.ms
www.gstatic.com www.google.com |
2 | fonts.gstatic.com |
fonts.googleapis.com
www.google.com |
2 | stackpath.bootstrapcdn.com |
www.roblox.com.ms
stackpath.bootstrapcdn.com |
1 | media.discordapp.net |
www.roblox.com.ms
|
1 | ajax.googleapis.com |
www.roblox.com.ms
|
1 | cdn.jsdelivr.net |
www.roblox.com.ms
|
1 | fonts.googleapis.com |
www.roblox.com.ms
|
1 | vvwvv-roblox-com.cf | |
25 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vvwvv-roblox-com.cf R3 |
2022-02-27 - 2022-05-28 |
3 months | crt.sh |
roblox.com.ms R3 |
2022-02-17 - 2022-05-18 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-02-17 - 2022-05-12 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2022-02-17 - 2022-05-12 |
3 months | crt.sh |
discordapp.net Cloudflare Inc ECC CA-3 |
2021-11-03 - 2022-11-02 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-02-17 - 2022-05-12 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2022-02-17 - 2022-05-12 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://vvwvv-roblox-com.cf/
Frame ID: F77C548B3AF01004B5B06C8A8BCFF6B0
Requests: 1 HTTP requests in this frame
Frame:
https://www.roblox.com.ms/creates/Dhiezz/
Frame ID: E6890D47FEB54AD777D84A5CF0686F46
Requests: 16 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenZJwdAAAAAPAGPUqmAxGln0cDmIrF373xpgSx&co=aHR0cHM6Ly93d3cucm9ibG94LmNvbS5tczo0NDM.&hl=de&v=85AXn53af-oJBEtL2o2WpAjZ&size=normal&cb=sqyl5x5e3zra
Frame ID: D6A0F999EB93DF71CCFBC96817F08DD7
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=de&v=85AXn53af-oJBEtL2o2WpAjZ&k=6LenZJwdAAAAAPAGPUqmAxGln0cDmIrF373xpgSx
Frame ID: 600EA7694C4CB662A40DA271B9B47C2C
Requests: 3 HTTP requests in this frame
Screenshot
![](/screenshots/fd09758b-8aa6-4718-b816-7b32ccb25ea7.png)
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/SweetAlert2.png)
Detected patterns
- /npm/sweetalert2@([\d.]+)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
![](/vendor/wappa/icons/reCAPTCHA.png)
Detected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.roblox.com.ms/creates/Dhiezz HTTP 301
- https://www.roblox.com.ms/creates/Dhiezz/
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
vvwvv-roblox-com.cf/ |
122 B 305 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.roblox.com.ms/creates/Dhiezz/ Frame E689 Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame E689 |
2 KB 930 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ Frame E689 |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.roblox.com.ms/generator/css/ Frame E689 |
218 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2@11
cdn.jsdelivr.net/npm/ Frame E689 |
66 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame E689 |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ Frame E689 |
850 B 968 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
www.roblox.com.ms/creates/Dhiezz/js/ Frame E689 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.js
www.roblox.com.ms/creates/Dhiezz/js/ Frame E689 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
www.roblox.com.ms/creates/Dhiezz/js/ Frame E689 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
www.roblox.com.ms/creates/Dhiezz/js/ Frame E689 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
images_5.jpeg
media.discordapp.net/attachments/899819211101204490/937167237020807188/ Frame E689 |
91 KB 91 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ Frame E689 |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame E689 |
266 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ Frame E689 |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/85AXn53af-oJBEtL2o2WpAjZ/ Frame E689 |
360 KB 142 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame D6A0 |
43 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/85AXn53af-oJBEtL2o2WpAjZ/ Frame D6A0 |
51 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/85AXn53af-oJBEtL2o2WpAjZ/ Frame D6A0 |
360 KB 142 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame D6A0 |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame D6A0 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame D6A0 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D6A0 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame D6A0 |
102 B 134 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 600E |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/85AXn53af-oJBEtL2o2WpAjZ/ Frame 600E |
51 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/85AXn53af-oJBEtL2o2WpAjZ/ Frame 600E |
360 KB 142 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
March 14th 2022, 7:02:03 pm
UTC —
From United States
Threats:
Phishing
Comment: This domain is present in the Sinking Yachts anti-phishing list. More Info: https://sinking.yachts
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| structuredClone object| oncontextlost object| oncontextrestored0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
media.discordapp.net
stackpath.bootstrapcdn.com
vvwvv-roblox-com.cf
www.google.com
www.gstatic.com
www.roblox.com.ms
162.159.129.232
20.212.178.58
2606:4700::6810:5814
2606:4700::6812:acf
2a00:1450:4001:802::200a
2a00:1450:4001:803::2003
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2004
35.186.245.55
08ec7021cb4983ee1870e2bdd0beac15ff38675f06ded4e6a9f2bdf2fb67cf64
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0f78f75320dd57ed94f05a30758a5044fe7ccdfef38669edc228f972414834f1
15f9c75454fbc8c7a512938af4ebbe852cd2fe82b8bd32ec98222a231b8a7e12
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
5e789ae095f1a270422a9df889576f5c71891f5ac8fdea7d636b4859e9a9016c
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
6a2f9fe05591ff3a4d6e522155d556b22c064a5b6a9581f12cee324ab730a733
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e4a339bbeae47cbf7ccbb73c695e12f0a7fd73938c15f0019f3476fc295ba8e
86352c676d2fd2676d13baeb99252be88e416d73e642dc50962e85773393cf06
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
bafa1db2a6708b6401e11e0b2ac4c5bb6eddf4c25e5a83b7eb391fe42ab34a2f
c7b4c457fb25020996821eba1c420ca294391d47851c9cd5b721f4eafdfb4596
dcc32d7f62ea184f22d4d24b2243505ca01793fbece8416cba8c883c2a00a403
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
f98ff8ab059bdef9ea7fe9165a4e74fce15166abdbb8dd25307b7b7d9ac26ddd
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e