Security Scan Report: g5.lu

Redirected to:
https://www.roblox.rw/games/2753915549/-Blox-Fruits?privateServerLinkC...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 30 IPs in 6 countries across 21 domains to perform 246 HTTP transactions. The main domain is g5.lu.

Submitted URL: https://g5.lu/du2sd

Effective URL:
https://www.roblox.rw/games/2753915549/-Blox-Fruits?privateServerLinkC...
Redirected

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Lookalike Roblox domain roblox.rw (reached via short-link g5.lu) reproduces a Roblox game page; both hosts carry single-source phishing reports. No forms, but clear brand impersonation warrants high risk.

Risk Factors (4)
Brand impersonation: Roblox branding and Roblox game-page content served on roblox.rw, not roblox.com
Single-source phishing threat-intel reports against both the entry domain g5.lu and the final domain roblox.rw
Cross-domain redirect from a young, unranked short-link domain (g5.lu, 32 days) into the impersonating host
Obfuscated lookalike domain naming (roblox.rw) used to appear official
Domain age information unavailable

Details

Page Title

[πŸŽƒ] Blox Fruits- Roblox

Scan Type

public

Domain Name Analysis

The domain name 'g5.lu' uses the Luxembourgish country-code top-level domain (.lu) without a subdomain. The second-level label 'g5' is 2 characters long holding 0 vowels versus 1 consonant, along with 1 digit. Segmentation suggests 2 words: g, 5. Expect 1 character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://g5.lu/du2sd

Page Load Overview

13.66s
Total Load Time
4.9 MB
Total Size

Language Analysis

Primary Language

πŸ‡ΊπŸ‡ΈEnglish
Code: en
Confidence:51%
Script:Latin
Direction:ltr

Detection Details

Text Length:2,637 chars
Detector Agreement:80%

Website Classification

Primary Category

corporate70% confidence
Type: spa
Method: structural

All Detected Categories

corporate
70%

Detected Features

Search
OG: game
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1445.61.188.96Miami, Florida, United States
AS53667FranTech Solutions
818.66.112.38Cloudfront Β· CDNUnited States
AS16509Amazon.com, Inc.
818.64.211.118Cloudfront Β· CDNUnited States
AS16509Amazon.com, Inc.
83.174.46.125Cloudfront Β· CDNUnited States
AS16509Amazon.com, Inc.
8128.116.44.3Frankfurt am Main, Hesse, Germany
AS22697Roblox
895.100.248.154Akamai Β· CDNBerlin, State of Berlin, Germany
AS20940Akamai International B.V.
854.192.35.83Cloudfront Β· CDNUnited States
AS16509Amazon.com, Inc.
8142.251.14.97Google Β· CDNUnited States
AS15169Google LLC
834.160.81.0Google Β· CDNKansas City, Missouri, United States
AS396982Google LLC
818.66.112.18Cloudfront Β· CDNUnited States
AS16509Amazon.com, Inc.
24630--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15AD3FAA3FBA5B436E85B82F9A0257554D550D917C90ACC80F0FCB3B82FC4EE36A53952

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:+qknXc0KTlVOqtzhW5XG/QlG0pUil7dDfaBMc:JMXc0KTrOqtzhW5XG/QlG0pUijDfC

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:130600:kChKJ0mQtIQIADCCOQQA66CEA0KA/BFZGoDAOY0BAGdoAQISASHFpgOSCRQEAwjAkqOeRFU8gyBClE66UE1NEIBhAFOqAJQA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c3c7ffffffff
Perceptual Hash:b030d3cfcf446ccc
Difference Hash:8e0c8e0e223e1e38
Wavelet Hash:028783c3c3c3cfcf
Color Hash:#71862d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data