WEBSITE ANALYSIS REPORT

https://www.roblox.com.bn/users/932017202200/profileexploitmalwarenetwork

17 Oct 2026 · 23:54:42.000 UTCpublic

Report tags
Submit tags: openphish

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

23:53:27.038 GET 200 document 122.7 KB 146 ms 4 alerts

Transaction #225

Request / response

URL

GET HTTPS

https://www.roblox.com.bn/users/932017202200/profileexploitmalwarenetwork

IP / ASN

179.43.182.61

AS51852 · Private Layer INC

Requested by: Not recorded

Resource information

File type: HTML document, Unicode text, UTF-8 text, with very long lines (5202)
MIME type: text/html; charset=UTF-8
First seen (UTC): 17 Oct 2026 · 21:34:41.386 UTC
Last seen (UTC): 17 Oct 2026 · 23:55:17.432 UTC
Times seen: 4

Size: 122.7 KB (125626 bytes)
MD5: 84ff020df4f1530c03bf37bda39111c9
SHA1: 52ffbbac616b145a42d3a839bb977921d2cd8b2c
SHA256: a305e2d5a1406cd54d7d468b81bb5a0f7b22a99e67b801b992ca1a3153ce08a7

Certificate information

Issuer: Let's Encrypt · YR2
Subject: roblox.com.bn
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 94:1E:05:59:64:10:44:A4:96:8F:A1:85:59:F1:5A:AD:CB:93:D7:0A
Valid from: Wed, 23 Sep 2026 20:15:40 GMT
Valid until: Tue, 22 Dec 2026 20:15:39 GMT

Technology fingerprints

PHP (Programming languages)
AngularJS (JavaScript frameworks)
HSTS (Security)
Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
OpenDNS Phishing Block	medium	Phishing
Quad9 DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /users/932017202200/profileexploitmalwarenetwork HTTP/1.1
Host: www.roblox.com.bn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
server: nginx
date: Sat, 17 Oct 2026 23:53:27 GMT
content-type: text/html; charset=UTF-8
content-length: 26328
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-security-policy: frame-ancestors *
vary: Accept-Encoding
content-encoding: gzip
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff, nosniff
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000
clear-site-data: "cache"
set-cookie: PHPSESSID=adqakb57p0t83seq2afhjk5fjv; path=/; secure; HttpOnly; SameSite=None
obs_cv=6ad26ecd; Path=/; Max-Age=2592000; Secure; HttpOnly; SameSite=Lax
X-Firefox-Spdy: h2

23:53:27.540 GET 200 script 808.0 KB 72 ms —

23:53:27.542 GET 200 script 319 B 62 ms —

23:53:27.544 GET 200 script 284.7 KB 76 ms —

23:53:27.546 GET 200 script 277.1 KB 64 ms —

23:53:27.547 GET 200 script 241.6 KB 74 ms —

23:53:27.550 GET 404 script 0 B 0 ms 4 alerts

23:53:27.551 GET 200 stylesheet 120.0 KB 54 ms —

23:53:27.553 GET 200 stylesheet 914.5 KB 50 ms —

23:53:27.554 GET 200 stylesheet 21.2 KB 39 ms —

23:53:27.556 GET 200 stylesheet 2.2 KB 37 ms —

23:53:27.558 GET 200 stylesheet 249 B 36 ms —

23:53:27.559 GET 200 stylesheet 2.5 KB 38 ms —

23:53:27.561 GET 200 stylesheet 43.4 KB 8 ms —

23:53:27.562 GET 200 stylesheet 10.1 KB 4 ms —

23:53:27.564 GET 200 stylesheet 475 B 5 ms —

23:53:27.566 GET 200 stylesheet 12.8 KB 6 ms —

23:53:27.567 GET 200 stylesheet 288 B 4 ms —

23:53:27.569 GET 200 stylesheet 275.8 KB 9 ms —

23:53:27.570 GET 200 stylesheet 130.4 KB 8 ms —

23:53:27.572 GET 200 stylesheet 2.4 KB 6 ms —

23:53:27.574 GET 200 stylesheet 6.1 KB 6 ms —

23:53:27.576 GET 200 stylesheet 12.3 KB 324 ms —

23:53:27.578 GET 200 stylesheet 37.5 KB 111 ms —

23:53:27.579 GET 200 stylesheet 6.7 KB 6 ms —

23:53:27.581 GET 200 stylesheet 3.7 KB 3 ms —

23:53:27.582 GET 200 stylesheet 6.9 KB 3 ms —

23:53:27.584 GET 200 stylesheet 5.9 KB 6 ms —

23:53:27.585 GET 200 stylesheet 4.2 KB 7 ms —

23:53:27.587 GET 200 stylesheet 1.4 KB 7 ms —

23:53:27.588 GET 200 stylesheet 9.3 KB 8 ms —

23:53:27.589 GET 200 stylesheet 739 B 5 ms —

23:53:27.590 GET 200 stylesheet 3.5 KB 8 ms —

23:53:27.591 GET 200 stylesheet 254 B 7 ms —

23:53:27.592 GET 200 stylesheet 29.7 KB 5 ms —

23:53:27.594 GET 200 stylesheet 31.2 KB 4 ms —

23:53:27.595 GET 200 stylesheet 1.4 KB 3 ms —

23:53:27.596 GET 200 stylesheet 2.2 KB 3 ms —

23:53:27.597 GET 200 stylesheet 5.7 KB 3 ms —

23:53:27.599 GET 200 stylesheet 784 B 3 ms —

23:53:27.600 GET 200 stylesheet 3.3 KB 4 ms —

23:53:27.602 GET 200 stylesheet 85 B 3 ms —

23:53:27.603 GET 200 script 11.5 KB 32 ms 4 alerts

23:53:27.605 GET 200 script 137.9 KB 15 ms —

23:53:27.606 GET 200 script 209.2 KB 14 ms —

23:53:27.607 GET 200 script 4.5 KB 6 ms —

23:53:27.608 GET 200 script 6.4 KB 5 ms —

23:53:27.609 GET 200 script 103.5 KB 13 ms —

23:53:27.610 GET 200 script 6.1 KB 4 ms —

23:53:27.612 GET 200 script 0 B 0 ms —

https://www.roblox.com.bn/users/932017202200/profileexploitmalwarenetwork

Domain graph

Hostnames

Connections