Security Scan Report: g5.lu

Redirected to:
https://www.roblox.com.pt/games/10959918411/Studio-Lite?privateServerL...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 31 IPs in 4 countries across 21 domains to perform 236 HTTP transactions. The main domain is g5.lu.

Submitted URL: https://g5.lu/m3xgy

Effective URL:
https://www.roblox.com.pt/games/10959918411/Studio-Lite?privateServerL...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Shortener g5.lu redirects to roblox.com.pt, a typosquat cloning the Roblox site with a private-server lure; both domains carry phishing reports. Do not sign in or download anything.

Risk Factors (5)
Impersonation of Roblox on a non-official typosquat domain (roblox.com.pt)
Obfuscated entry via link shortener (g5.lu) hiding the final destination
Threat-intelligence phishing reports on both domains in the redirect chain
Cloned Roblox UI and meta tags to appear as the official platform
Private-server invite lure used to draw in Roblox users
Domain age information unavailable

Details

Page Title

Studio Lite- Roblox

Scan Type

public

Domain Name Analysis

The domain name 'g5.lu' uses the Luxembourgish country-code top-level domain (.lu) without a subdomain. The core label 'g5' covers 2 characters with 0 vowels and 1 consonant; it also includes 1 digit. Segmentation suggests 2 words: g, 5. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://g5.lu/m3xgy

Page Load Overview

25.44s
Total Load Time
3.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:58%
Script:Latin
Direction:ltr

Detection Details

Text Length:2,898 chars
Detector Agreement:100%

Website Classification

Primary Category

entertainment media46% confidence
Type: spa
Method: ml+structural

All Detected Categories

entertainment media
46%
technology software
46%
corporate
35%
documentation technical
30%

Detected Features

Search
OG: game
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2645.61.188.96Miami, Florida, United States
AS53667FranTech Solutions
718.66.112.62Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
718.64.211.63Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
73.174.46.125Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
7128.116.44.3Frankfurt am Main, Hesse, Germany
AS22697Roblox
718.64.211.88Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
754.192.35.83Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
7142.251.127.97Google · CDNUnited States
AS15169Google LLC
734.160.81.0Google · CDNKansas City, Missouri, United States
AS396982Google LLC
718.66.112.121Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
23631--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19AD30AA3FBA5B437E45B82F5A0227544D551D917C90AC880F0FCB3B82FC4EE36A53956

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:+qx+ZW+ZyC+ZSXc0KylKOqJymnfKA+1spij7LDfadMc:JSXc0KyAOqJymnfKBspiDDfe

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:131034:EhkiMQRAoAQALBsBIXLBEEBIGkI6wAkiKQAhBHEpgWyZCQgCQYYDIlcKDBIamAAnISO5JMG2KKSyyGMIAEAIMhkyAkrmsiWK

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c3c7ffffffff
Perceptual Hash:b131c6cece6c6945
Difference Hash:9e1c9e1e261e1e18
Wavelet Hash:02c6c2c3c3c7c7cf
Color Hash:N/A

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data