# PhishDestroy domain threat record: real-executor.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/real-executor.github.io/
Machine-readable companion: https://phishdestroy.io/domain/real-executor.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-12 11:40:21 UTC
- Last availability or vendor check: 2026-10-22 10:06:51 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 2/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Roblox

## Stored infrastructure

- Observed IP address: 185.199.109.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 200
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0956c-bc3a-74cb-b984-37e9106cf38c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/real-executor.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.real-executor.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://real-executor.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
real-executor.github.io is a gaming-themed scam aimed at Roblox players. It presents itself as "Real Executor — Next Gen Roblox Executor", a tool that supposedly lets users inject scripts and cheats into Roblox games. PhishDestroy first flagged it on 2026-09-12, and the page was still online and serving its content when last checked on 2026-10-19.

How the scam works
Executor sites lure players, often younger ones, with the promise of free exploits, unlimited items or game advantages. Schemes of this type usually ask the visitor to download and run a file, disable antivirus because it will "falsely" flag the cheat, or sign in with a Roblox account to activate the tool. The download is commonly an information stealer that harvests saved browser passwords, session cookies and Discord or Roblox logins. A login prompt hands the account straight to the operator. Either way, the victim risks losing the Roblox account, its Robux and limited items, and any other accounts stored on the same computer.

Evidence
Detection by security vendors is still thin. When the site was scanned on 2026-09-25, only 2 of 91 VirusTotal engines flagged it: alphaMountain.ai and Forcepoint ThreatSeeker. PhishDestroy is currently the only blocklist carrying the domain, so most browsers and antivirus products will not warn visitors yet. That gap is why the classification is being published.

Infrastructure
The site is a free GitHub Pages project, served through Fastly's network from the United States. A page like this costs nothing to set up and can be recreated under a new project name within minutes, which suits throwaway cheat-download lures. The fact that it was hosted on github.io does not make it a legitimate GitHub-endorsed tool.

What to do
If you only viewed the page, close it and do not return. If you downloaded or ran anything from it, disconnect that computer from the internet and run a full scan with a reputable antivirus. Then change your Roblox, Discord, email and browser-saved passwords from a different, clean device. Turn on two-step verification in Roblox and sign out of all other sessions. If you entered Roblox credentials on the site, reset the password immediately and check your inventory and trades. Parents should talk with children about "free executor" offers. Security teams should block the domain and report the project to GitHub for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0956c-bc3a-74cb-b984-37e9106cf38c/
VirusTotal report: https://www.virustotal.com/gui/domain/real-executor.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=real-executor.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:47:32 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0956c-bc3a-74cb-b984-37e9106cf38c.png
  Captured: 2026-09-12 11:40:21 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0956c-bc3a-74cb-b984-37e9106cf38c.png
  Captured: 2026-09-22 03:30:41 UTC
  Source report: https://urlscan.io/result/01a0956c-bc3a-74cb-b984-37e9106cf38c/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1fa5a777-6a0c-4be2-b51c-df7be3bf7860.png
  Captured: 2026-09-20 00:11:11 UTC
  Source report: https://radar.cloudflare.com/scan/1fa5a777-6a0c-4be2-b51c-df7be3bf7860
  SHA-256: 9883dc6c0a5d08b6b9e413dbc8d474c3acadba4489caeac89c08f5b0b9a9200e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:26:21Z",
        "uuid": "01a0956c-bc3a-74cb-b984-37e9106cf38c",
        "scanned_at": "2026-09-12T11:42:14Z",
        "final_url": "https://real-executor.github.io/",
        "status": 200,
        "ip": "2606:50c0:8002::153",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "gc.zgo.at"
        ],
        "ips": [
            "2607:f8b0:4006:802::2003",
            "2607:f8b0:4004:c1d::5f",
            "2606:50c0:8002::153"
        ],
        "asns": [
            "15169",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "7373d1acafe17388b115e58f097e1ffaaea2a264ceaeb30188a4785d9d9a34f7",
        "script_hashes": [
            "30aa5037fe05e5e0e9d9e67f0f609736ad1fc931586e4add1ef02a050f2e5edc"
        ],
        "globals": [
            "downloadLatestInstaller",
            "demoDownload",
            "menuButton",
            "nav"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 11,
        "apex_age_days": 11,
        "tls_age_days": 40,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:07Z",
        "uuid": "1fa5a777-6a0c-4be2-b51c-df7be3bf7860",
        "scanned_at": "2026-09-20T00:11:11Z",
        "final_url": "https://real-executor.github.io/",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://real-executor.github.io/",
                "status": 307
            },
            {
                "url": "https://real-executor.github.io/",
                "status": 200
            }
        ],
        "dom_hash": "ee08936f439dfea82251d191c58ed00abb7fa4a4914c2baf5bc6f20e11202853",
        "doc_hash": "7373d1acafe17388b115e58f097e1ffaaea2a264ceaeb30188a4785d9d9a34f7",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "real-executor.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "real-executor.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "real-executor.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "real-executor.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "real-executor.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "real-executor.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "real-executor.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "real-executor.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.108.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:47:11Z",
        "analysis_at": "2026-10-21T01:27:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-11T08:12:52Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            }
        ],
        "dns_at": "2026-10-21T01:27:37Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```