# PhishDestroy domain threat record: g4mecreat0r.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/g4mecreat0r.github.io/
Machine-readable companion: https://phishdestroy.io/domain/g4mecreat0r.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-11 17:09:17 UTC
- Last availability or vendor check: 2026-10-21 01:14:22 UTC
- Stored record updated: 2026-10-22 14:22:24 UTC
- VirusTotal detections in the stored snapshot: 1/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: roblox

## Stored infrastructure

- Observed IP address: 185.199.111.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0908e-68db-77b8-bb4b-a0fc9e5353de/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/g4mecreat0r.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.g4mecreat0r.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://g4mecreat0r.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
g4mecreat0r.github.io is a gaming scam that dressed itself up as Roblox, with the page title "atblaw - Roblox". It was aimed at Roblox players, many of them young, who look for free in-game currency, items or creator tools. PhishDestroy first saw it on 2026-09-11. It went offline on 2026-09-12, and on 2026-10-19 the site was still dead with nothing served at its root.

How the scam works
Roblox-branded scam pages usually promise free Robux, rare items or a game-creator perk. To claim it, the visitor is asked to log in with their Roblox credentials, "verify" their account, or paste in a code or browser data that quietly hands over their session. The handle "g4mecreat0r" fits that creator-tools pitch. Victims lose control of their Roblox account, including any purchased currency, limited items and linked payment methods, and the hijacked account is often used to spread the same lure to friends.

Evidence
urlscan.io rated the page malicious and recognised Roblox branding on it, which matches our classification. VirusTotal coverage was thin. When checked on 2026-09-11, only Gridinsoft out of 89 engines flagged it. That low count reflects how quickly the page appeared and vanished, not a clean bill of health. PhishDestroy lists the domain on its blocklist.

Infrastructure
The site ran as a free GitHub Pages project rather than on a purchased domain. That kind of setup costs nothing, takes minutes to create and borrows the trust of a well-known platform's address. Traffic was served through Fastly's network (AS54113) in the United States, the content-delivery layer GitHub Pages uses. The page lasted about a day after we first saw it, which is a typical lifespan for throwaway scam pages hosted on free platforms.

What to do
If you entered your Roblox login on this page, change your Roblox password at once and turn on 2-Step Verification. Then use the option to log out of all other sessions, and check that the account email and phone number are still yours. If you pasted any code or browser data the page asked for, treat the account as compromised and do the same steps. Change the password on your email account too if it shares the Roblox password. Review recent Robux and item transactions, and report any account takeover to Roblox Support. Parents should talk with children about "free Robux" offers. Defenders can block the hostname and report similar GitHub Pages projects that impersonate Roblox to GitHub.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0908e-68db-77b8-bb4b-a0fc9e5353de/
VirusTotal report: https://www.virustotal.com/gui/domain/g4mecreat0r.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=g4mecreat0r.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:52:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0908e-68db-77b8-bb4b-a0fc9e5353de.png
  Captured: 2026-09-11 17:09:17 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/13be3771-ddce-4879-95dd-10807e8304f8.png
  Captured: 2026-09-11 17:10:55 UTC
  Source report: https://radar.cloudflare.com/scan/13be3771-ddce-4879-95dd-10807e8304f8
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a09174-f656-71f9-87bd-af15de993fd5.png
  Captured: 2026-09-11 17:12:42 UTC
  Source report: https://urlscan.io/result/01a09174-f656-71f9-87bd-af15de993fd5/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0abf2-32ba-758a-abfc-75af7753e71d.png
  Captured: 2026-09-16 20:39:40 UTC
  Source report: https://urlscan.io/result/01a0abf2-32ba-758a-abfc-75af7753e71d/
  SHA-256: ebd8f77f75fa9352ef056fc82f7bf4281668fe687bd13ca650c6d3079f622ffd
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0bb24-7aed-77ec-969f-27a9a794f569.png
  Captured: 2026-09-19 19:28:59 UTC
  Source report: https://urlscan.io/result/01a0bb24-7aed-77ec-969f-27a9a794f569/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0bc11-abd1-72dd-91c0-8d166c41d5f7.png
  Captured: 2026-09-19 23:48:06 UTC
  Source report: https://urlscan.io/result/01a0bc11-abd1-72dd-91c0-8d166c41d5f7/
  SHA-256: ebd8f77f75fa9352ef056fc82f7bf4281668fe687bd13ca650c6d3079f622ffd
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f1c2-d09a-75bd-866d-c45ca9233a9a.png
  Captured: 2026-09-30 10:01:21 UTC
  Source report: https://urlscan.io/result/01a0f1c2-d09a-75bd-866d-c45ca9233a9a/
  SHA-256: ebd8f77f75fa9352ef056fc82f7bf4281668fe687bd13ca650c6d3079f622ffd

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:18:54Z",
        "uuid": "01a0908e-68db-77b8-bb4b-a0fc9e5353de",
        "scanned_at": "2026-09-11T13:00:54Z",
        "final_url": "https://g4mecreat0r.github.io/est/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://g4mecreat0r.github.io/est/",
                "from": "https://g4mecreat0r.github.io/est",
                "status": 301
            }
        ],
        "ip": "185.199.109.153",
        "ptr": "cdn-185-199-109-153.github.com",
        "domains": [
            "js.rbxcdn.com",
            "css.rbxcdn.com",
            "images.rbxcdn.com",
            "ecsv2.roblox.com",
            "static.rbxcdn.com",
            "ssl.google-analytics.com",
            "roblox.com",
            "apis.roblox.com",
            "metrics.roblox.com"
        ],
        "ips": [
            "128.116.44.3",
            "142.251.110.97",
            "23.32.239.9",
            "128.116.102.3",
            "2.16.164.42",
            "23.32.239.82",
            "23.32.239.43",
            "185.199.109.153"
        ],
        "asns": [
            "22697",
            "15169",
            "20940",
            "54113"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "d5b1b0551679f18310ba896d0450c6f5647a3bd9a2fcd119bc98ebd92ea384ed",
        "globals": [
            "Roblox",
            "$",
            "jQuery",
            "minifyTest",
            "clearImmediate",
            "setImmediate",
            "regeneratorRuntime",
            "HeaderScripts",
            "RobloxTracer",
            "_gaq",
            "GoogleAnalyticsDisableRoblox2",
            "EventTracker",
            "IntlPolyfill",
            "GoogleAnalyticsEvents",
            "makeGoogleAnalyticsLogObject",
            "GoogleAnalyticsTimingTracker",
            "RBXBaseEventListener",
            "RobloxError",
            "isInitialized",
            "fitStringSpan",
            "InitStringTruncator",
            "fitStringToWidth",
            "fitStringToWidthSafe",
            "fitStringToWidthSafeText",
            "jQuery111107670042880727714",
            "_",
            "RobloxEventManager",
            "GoogleListener",
            "mCustomScrollbar",
            "_gat",
            "React",
            "ReactJSX",
            "ReactDOM",
            "ReactDOMServer",
            "ReactRedux",
            "ReactRouter",
            "ReactRouterDOM",
            "Redux",
            "ReduxThunk",
            "PropTypes"
        ],
        "storage_keys": [
            "theme",
            "localstorage_validation_test",
            "RobloxUse3DThumbnailsV2",
            "roblox",
            "Roblox.CrossTabCommunication.Kingmaker.electionInProgress",
            "Roblox.CrossTabCommunication.Kingmaker.masterId",
            "RobloxLocaleCode",
            "Roblox.CrossTabCommunication.Kingmaker.masterLastResponseTime"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 164,
        "apex_age_days": 164,
        "tls_age_days": 39,
        "tls_valid_days": 89,
        "requests": 175,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "roblox"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Roblox"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:53Z",
        "uuid": "13be3771-ddce-4879-95dd-10807e8304f8",
        "scanned_at": "2026-09-11T17:10:55Z",
        "final_url": "https://g4mecreat0r.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://g4mecreat0r.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "g4mecreat0r.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "g4mecreat0r.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:21:23Z",
        "analysis_at": "2026-10-11T15:55:36Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 13,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-10T11:11:07Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            }
        ],
        "dns_at": "2026-10-11T17:05:06Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "59e7c420f8943f524ab370807c836bb57fe",
            "sha256": "71f1077db377fd7b8d68380da66fa68238a303b2911bcb770b3b2a426693cf84",
            "subject": "*.github.io",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```