www.robloxmod.tk
Open in
urlscan Pro
2a00:1450:4001:80f::2013
Malicious Activity!
Public Scan
Effective URL: https://www.robloxmod.tk/
Submission Tags: phish.gg anti.fish automated Search All
Submission: On April 21 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1D4 on April 11th 2023. Valid for: 3 months.
This is the only time www.robloxmod.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 216.239.36.21 216.239.36.21 | 15169 (GOOGLE) (GOOGLE) | |
1 3 | 2a00:1450:400... 2a00:1450:4001:80f::2013 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:831::2009 | 15169 (GOOGLE) (GOOGLE) | |
19 | 2600:9000:212... 2600:9000:2127:2e00:1c:b3e3:eb40:21 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:212... 2600:9000:2127:2400:0:a5b4:dd80:21 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 2600:9000:212... 2600:9000:2127:7200:1c:8de0:8c80:21 | 16509 (AMAZON-02) (AMAZON-02) | |
31 | 6 |
ASN15169 (GOOGLE, US)
PTR: any-in-2415.1e100.net
robloxmod.tk |
ASN16509 (AMAZON-02, US)
d13pxqgp3ixdbh.cloudfront.net |
ASN16509 (AMAZON-02, US)
db81lfl43r06.cloudfront.net |
ASN16509 (AMAZON-02, US)
d2punpeg7vtjci.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
cloudfront.net
d13pxqgp3ixdbh.cloudfront.net db81lfl43r06.cloudfront.net d2punpeg7vtjci.cloudfront.net |
381 KB |
4 |
robloxmod.tk
2 redirects
robloxmod.tk www.robloxmod.tk |
8 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3240 |
83 KB |
2 |
blogger.com
www.blogger.com — Cisco Umbrella Rank: 7869 |
63 KB |
31 | 4 |
Domain | Requested by | |
---|---|---|
19 | d13pxqgp3ixdbh.cloudfront.net |
www.robloxmod.tk
|
5 | d2punpeg7vtjci.cloudfront.net |
db81lfl43r06.cloudfront.net
|
3 | www.robloxmod.tk |
1 redirects
www.robloxmod.tk
|
2 | stackpath.bootstrapcdn.com |
www.robloxmod.tk
stackpath.bootstrapcdn.com |
2 | www.blogger.com |
www.robloxmod.tk
|
1 | db81lfl43r06.cloudfront.net |
www.robloxmod.tk
|
1 | robloxmod.tk | 1 redirects |
31 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.blogger.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.robloxmod.tk GTS CA 1D4 |
2023-04-11 - 2023-07-10 |
3 months | crt.sh |
*.blogger.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2022-12-08 - 2023-12-07 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.robloxmod.tk/
Frame ID: 59BB29B5AA521B6CD97CF360A308FE7B
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
roblox mod 2022Page URL History Show full URLs
-
http://robloxmod.tk/
HTTP 301
http://www.robloxmod.tk/ HTTP 301
https://www.robloxmod.tk/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Weitere Informationen
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://robloxmod.tk/
HTTP 301
http://www.robloxmod.tk/ HTTP 301
https://www.robloxmod.tk/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.robloxmod.tk/ Redirect Chain
|
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
466517130-widget_css_bundle_rtl.css
www.blogger.com/static/v1/widgets/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810199a3073e46082b0e0d3a7ca4abaafc21fc.css
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
103 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810199673797c1e15941bdf458d49cd8a045fe.css
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15942998837ed1b3a9e78abad8329fa3af5ec8c769.css
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15218101990c531a0f9f6c7e75193d8dd38faec440.css
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
16 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810199d194fdee0f32436cbf5ad4fd8e6e72f1.css
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
7 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15218102635d062eca372ef05dd9e4e66a6772bdc6.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
90 KB 91 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810261c0031a6dfe8768aa8a1282bfe82d9bda.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
17 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15218102608c4175622fba7bd7f7cca124e0d4ea09.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
28 KB 28 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810261adf59b830e805b61f38007133d2c7fb1.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
17 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15218102628d1d78fd8022d895e635d239637d6fca.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
2 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15979315638152d30ed3fd8e340cf55c4a3ded9154.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15979315904f0c585819d1b5ee9858970abd434141.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810240fa6d6ceb2d870281aaaea55ee2c2bd26.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
152181024216cba87166e81f8e9bc897092defd5b0.gif
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
24 KB 24 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810239d60abf38ed2c1ae54b2f2fa468647abf.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
152181023944acce3c78f0947116f4e29a4f861e5e.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
152181025191c71b3d6964ee7362e6fad3523664d1.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ |
421 B 788 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1521810261ee515a23e0a3754143a7be69e96503e7.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
3 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15966295701d4fdc83f61a03e9cb767d5eaca32e63.js
d13pxqgp3ixdbh.cloudfront.net/uploads/assets/ |
826 B 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CZG5SO.js
db81lfl43r06.cloudfront.net/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookienotice.js
www.robloxmod.tk/js/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2659626136-widgets.js
www.blogger.com/static/v1/widgets/ |
154 KB 56 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
html.2554482.b3924.0.js
d2punpeg7vtjci.cloudfront.net/public/external/v2/ |
9 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css_front.css
d2punpeg7vtjci.cloudfront.net/public/external/ |
6 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
d2punpeg7vtjci.cloudfront.net/public/clockers/PrimeApps/ |
1010 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guid
d2punpeg7vtjci.cloudfront.net/public/ |
0 276 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check.php
d2punpeg7vtjci.cloudfront.net/public/external/ |
78 B 371 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)65 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| adsbygoogle function| $ function| jQuery object| jQuery191038286733556950536 string| globalString function| b64DecodeUnicode string| decodedGlobalVariables function| waitForLocker object| globalVariables object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker function| BLOG_attachCsiOnload function| _WidgetManager function| _WidgetInfo function| widget_module_provide function| _AdSenseView function| _BlogArchiveView function| _AttributionView function| _BlogView function| _BlogListView function| _BlogSearchView function| _ContactFormView function| _ExampleView function| _FeaturedPostView function| _FeedView function| _FollowersView function| _HeaderView function| _TextView function| _HTMLView function| _ImageView function| _LabelView function| _TextListView function| _LinkListView function| _BloggerButtonView function| _NavbarView function| _PageListView function| _PollView function| _PopularPostsView function| _ProfileView function| _RecentPostsView function| _ReportAbuseView function| _SharingView function| _StatsView function| _SubscribeView function| _SW_toggleReaderList function| _SW_hideReaderList function| _TranslateView function| _WikipediaView string| __wavt object| cookieChoices1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.robloxmod.tk/ | Name: _cpguid Value: 2cmt4yvjd |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d13pxqgp3ixdbh.cloudfront.net
d2punpeg7vtjci.cloudfront.net
db81lfl43r06.cloudfront.net
robloxmod.tk
stackpath.bootstrapcdn.com
www.blogger.com
www.robloxmod.tk
216.239.36.21
2600:9000:2127:2400:0:a5b4:dd80:21
2600:9000:2127:2e00:1c:b3e3:eb40:21
2600:9000:2127:7200:1c:8de0:8c80:21
2606:4700::6812:acf
2a00:1450:4001:80f::2013
2a00:1450:4001:831::2009
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
17605e3431048c62e5863114ce9d20aaa265facbea96a7ff8c9ee3a985578fb3
27d685572f17063e83bc38e22354ec11e9dd0901a7fa846ad6aef26bb0bb8783
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2f3672368c69a2507b4831343afd5267fa31d09fdaaa520731272b072efe9315
397733364041c86da6e5df0150e120e3b642bb91b2edb6b0fa7f2661cfb1e122
3f9232bf3cf18aa80d6bd131c5518bb22bff12a4d20d52beea4da1fa781a8a94
677b226d4146ce42e754b956469c878d217e2cf803a97912c3ebb3b0ba336e49
7128c3dd35bd13376ad01db6d1c538815e90aa93bbe9887edb129e1c31a8cd5d
7470f9d78491838f5cc3ee51d4ed4d8a232f6c80ae80706dff96c062d3d663b6
76a06227945b3f8215623543deed9aef209aad313f90eb1ab3b7ed367d0c238c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7bab9fd009c270dcada786352677f89c3a050ef2de4f1c7d3a1fa010f24a818d
831fc49e151c83957002e3c9d9ebab0b25b0aaccc62974da8e04ab54af2b6f54
8589a5e91564f0c284f82e931576fcd5eb8e6d38c89a07bb1b62b1750979c28e
90712374aeb637592d296d5687cc3e7cd678e09c22128c1a6e171ce3bfe387d4
97d73d5d4ee6171edded65a2bbc9b5eafd5c99419cd31025f32eaa95c9fa23e6
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a10def365fe84f964ae0eeb764dc703dca3a4aabcb80d8f6132e5e15dad08fef
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
ad9e9a9e627e664138904d52f7a83bd441c916757e4c89e894f39c9cbbf28031
b182c213c31b5bfb811007e52b6cedd7391fd27185a6e7b6d307a99ed50f9022
c0fa4b62de4f16ecc8a6fd51c9f2813f1ed21cfb8aab20e6645b7b8e69eddceb
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cc9827387e9f9c502215517410c716793c475fa6f0b49ec7cea16539fe9dccc6
d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300
d239a6eca57ef5b76293f1517735fd8e2c885f85da15127a0cfd344588d9abe5
e0bb73a34c8f224157433d8fba4e43fb735884a903756a70bec79cf2dfb4a924
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee04c7b41523acac145033baa92aeabcbc7f04079de95999e8f005f8b024d2e1