{"report_id":"b1e3ff2a-5cd3-43b7-8e56-9558cbbffdb2","version":0,"status":"done","tags":[],"date":"2026-08-16T20:38:26Z","url":{"schema":"https","addr":"rblxhelper.co/","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":0,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"rblxhelper.co/","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"title":"Free Robux in 2026!","dom":{"size":4741,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"b4f58badab9fc418479d637c2444574d","sha1":"942006026de77563a171e9b0e58490af25b1d167","sha256":"89f7f58c179aa9733ca84acd42ba8df82e5899d99ec63b482a97bc8f71c8cbd8","sha512":"e10ec922f5efe28fca4e013768e58d4a429f4768eb2e2bb25e5cdd4300fc9077ecf8c4a54bb6f63da05eaf260ebcedaebd3c305df5e86275ac53dc0f36a758e1","ssdeep":"48:nH6rILGYd5mRPoEs7HtXxdyUApFV7FzCivCBuFNIHlx/WENGcap:n/qwEs7H9xdjApFV7I/KNIHlBt76","tlshash":"6aa1005090f04a6a018344c838e66b1f3dc9e94feb1b14c8b6ed56ea1fd2c85cc73699","dom_hash":"domhash21e69dd6da61100ce7e9a52a1e230826","first_seen":"2026-08-16T20:38:27.269296Z","last_seen":"2026-08-16T20:38:27.269296Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"rblxhelper.co/","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":0,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-20T20:38:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rblxhelper.co","ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2020-06-29","domain_rank":0,"first_seen":"2026-06-04T06:00:28.825643Z","last_seen":"2026-06-21T13:58:41.173521Z","alert_count":60,"request_count":15,"received_data":492620,"sent_data":6956,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rblxhelper.co/popper.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"56456db9d72a4b380ed3cb63095e6022","sha1":"6dbce88aee15b42f29083df7a07513cf3b486ba0","sha256":"66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2","sha512":"e56bd96b837b26add354d0a9e2b8dc04c95cea94f7959ee05718ed23a224296fae22d49afab160b45963bd99c2c501a3f12517e431eb68a13a327ff8b262b50a","ssdeep":"384:kmQkLrwVOyzirVyKnxRsIB9Db5HjiWn8xHOxvRVgD75zBY5vImg3FzGpL9ARdOgS:vLsgyziJp3Db5OxHOxvYD73Y5vQzyL9p","tlshash":"1992b4cc3294b06643a791a7a0af960fb2339875610e9410f19df2d97c30ef9a13bc79","size":21004,"data":"","first_seen":"2023-03-07T01:06:27Z","last_seen":"2026-08-16T20:56:43.296533Z","times_seen":19994,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/bootstrap.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"e1d98d47689e00f8ecbc5d9f61bdb42e","sha1":"6778fed3cf095a318141a31f455c8f4663885bde","sha256":"0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b","sha512":"021e615983f30ec5477fd8b611e8c5045ac6d9900f9a9bb8649b56e0c7d282965a727f8cf501c3b7e1ddff02f5b44924d5481bcea7a926be8a9e166314a07ed0","ssdeep":"768:5NYyDyKAmHVaS3m3Dqp0NwCkXDtdFDLmTV+miDNJcJiQMRqyPiYtB6UvcCg8YGk:5NTKktDLmTF8yJL45XtHjoGk","tlshash":"1243c90a725478b205df9176917f420bb737688ae94ac16cb91d98ed1e7cc893227f3c","size":58072,"data":"","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-08-16T20:56:43.297316Z","times_seen":28471,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/countUp.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef08adac1bb93886318d9d5f458c9d70","sha1":"927214beec9cad5b22f6e92a6728deef20baf02e","sha256":"f662ddd0dc42f44d4bcc8b9b3916f7cfacbc867c255e2350067bcfc4a195ff46","sha512":"943d2a5b604db3d347105f82e0c5dd4680e64a1f50800b1bd33c23e89eaff52918d3c232b64d9853e7af107546bf467fb1a3dc4a8a52538ae7aeb1eab0a4e6c0","ssdeep":"96:o7/gu+j0EoMLuGQG2+xjDvGSkaT9ywZHW3F4LYrIFU4/2BN53I7Mxuvow0wfOM+6:M3+jDuSkaTPMeU3kgmfOOFL","tlshash":"88f195d5a75b22625a5333678c1f13cb263c8272389e1defecbb0294185402b5386ef9","size":7545,"data":"","first_seen":"2023-03-07T01:06:27Z","last_seen":"2026-08-16T20:56:43.298141Z","times_seen":120,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/main.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd3001c196b4b25d96f6d421898f1cf","sha1":"072f30f12f3b1fa0e625e0ad36cd870004e28ab5","sha256":"2518b3ec31bcad537e8f4a6dfc955e16292dd1481c7ae092b825abcdae03dca4","sha512":"11f0356d959f8d9a0d2399cfeac5624d3a14ec08e63a249402652d2733b5912375a532d8cd9559570c8eebdabbb037b3d5f301be7956ce1f6eb0dccf2c6ff644","ssdeep":"96:7S7+TfTZDfzCN3OSVOM53OSVCfCnJpk2Axc2kxc2a:7gMSVmaJpkLxc1xcb","tlshash":"7cc1ac0cf9011a1b4a3337e58d1b461eeb78627ff0164ed0b6de98e41f39155a332e9a","size":5878,"data":"","first_seen":"2024-08-19T21:38:03.085732Z","last_seen":"2026-08-16T20:40:31.381105Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/jquery-3.4.1.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e196ad1caad3d0925d0091837769d3d","sha1":"ec694a73f16abaf7825653404bacc2fbc4f8d038","sha256":"4779cfbe3f818fdaa497d4836c0d8663ac61c22093e2b9f3e9652f5543816405","sha512":"b93003a34b9342d2cf3710760d0daf2055d175af3cf7aa101d16cd8425a71efbba0a78891c0abaf286d2b0660d9ff04ff81500f40708263d3741431b425652de","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPms:ygZm0H5HO5+gCKWZyPmHQ47GKQ","tlshash":"5a9319cd72c6b06257b761ba007f540bf236199e6c4d4410f224e4eabc78a4a823bf7d","size":88799,"data":"","first_seen":"2025-02-23T01:54:20.148051Z","last_seen":"2026-08-16T20:40:31.382979Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rblxhelper.co/devices.min.css","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.990Z","timestamp":1786912678990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /devices.min.css HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 09 Apr 2026 11:28:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3473\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":27730,"size_decoded":3802,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"03958602d94b63cf09109bdf82513bcd","sha1":"e28d3de898f152abe36f3e20f78f4bbb914ad9d1","sha256":"5633df035604a708de9c711578df1528cc8ac8b1470e7cd027cc791caf5d622a","sha512":"470720d180be32a147e8294411797b1f49c1817115246b15d14ea76583d6b325eaaa0411268b964f7438732a8a50830f5fb794be85600577012665827ba465ba","ssdeep":"192:MTbyhpcyiggzf6FDWlC+RPpUhI3NlXQGYRysZKeAfgKoITFyxZQPDLRtn3:a+K6KlC+uIzKYxgKoIh3","tlshash":"50c2aef8da5e520d7a3fe6d4af43468a27270011a77207dbbbfc64a96ac056c1073dc9","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:56:43.302178Z","times_seen":20,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/jquery-3.4.1.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.994Z","timestamp":1786912678994,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /jquery-3.4.1.min.js HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Apr 2026 11:28:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 30343\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":88799,"size_decoded":30687,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"2e196ad1caad3d0925d0091837769d3d","sha1":"ec694a73f16abaf7825653404bacc2fbc4f8d038","sha256":"4779cfbe3f818fdaa497d4836c0d8663ac61c22093e2b9f3e9652f5543816405","sha512":"b93003a34b9342d2cf3710760d0daf2055d175af3cf7aa101d16cd8425a71efbba0a78891c0abaf286d2b0660d9ff04ff81500f40708263d3741431b425652de","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPms:ygZm0H5HO5+gCKWZyPmHQ47GKQ","tlshash":"5a9319cd72c6b06257b761ba007f540bf236199e6c4d4410f224e4eabc78a4a823bf7d","first_seen":"2025-02-23T01:54:20.148051Z","last_seen":"2026-08-16T20:40:31.382979Z","times_seen":8,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/popper.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.995Z","timestamp":1786912678995,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /popper.min.js HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Apr 2026 11:28:26 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7174\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21004,"size_decoded":7517,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20831)","md5":"56456db9d72a4b380ed3cb63095e6022","sha1":"6dbce88aee15b42f29083df7a07513cf3b486ba0","sha256":"66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2","sha512":"e56bd96b837b26add354d0a9e2b8dc04c95cea94f7959ee05718ed23a224296fae22d49afab160b45963bd99c2c501a3f12517e431eb68a13a327ff8b262b50a","ssdeep":"384:kmQkLrwVOyzirVyKnxRsIB9Db5HjiWn8xHOxvRVgD75zBY5vImg3FzGpL9ARdOgS:vLsgyziJp3Db5OxHOxvYD73Y5vQzyL9p","tlshash":"1992b4cc3294b06643a791a7a0af960fb2339875610e9410f19df2d97c30ef9a13bc79","first_seen":"2023-03-07T01:06:27Z","last_seen":"2026-08-16T20:56:43.296533Z","times_seen":19994,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/bootstrap.min.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.997Z","timestamp":1786912678997,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /bootstrap.min.js HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Apr 2026 11:28:19 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 14764\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":58072,"size_decoded":15108,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (57791)","md5":"e1d98d47689e00f8ecbc5d9f61bdb42e","sha1":"6778fed3cf095a318141a31f455c8f4663885bde","sha256":"0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b","sha512":"021e615983f30ec5477fd8b611e8c5045ac6d9900f9a9bb8649b56e0c7d282965a727f8cf501c3b7e1ddff02f5b44924d5481bcea7a926be8a9e166314a07ed0","ssdeep":"768:5NYyDyKAmHVaS3m3Dqp0NwCkXDtdFDLmTV+miDNJcJiQMRqyPiYtB6UvcCg8YGk:5NTKktDLmTF8yJL45XtHjoGk","tlshash":"1243c90a725478b205df9176917f420bb737688ae94ac16cb91d98ed1e7cc893227f3c","first_seen":"2023-03-07T01:02:33Z","last_seen":"2026-08-16T20:56:43.297316Z","times_seen":28471,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/BOTTOM.jpg","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.011Z","timestamp":1786912679011,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /BOTTOM.jpg HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 09 Apr 2026 11:28:19 GMT\r\naccept-ranges: bytes\r\ncontent-length: 30171\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":30171,"size_decoded":30458,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Windows), datetime=2020:03:02 23:14:10], baseline, precision 8, 945x108, components 3","md5":"59300de6fffc2dcd981dc826d126a578","sha1":"0c64cb9d93c603cc7340e448c4ee6f6271438a83","sha256":"98262cb4755e766680dab18aa85ea8f280c395f4982a5bf15b6c1642cfc6b353","sha512":"975f14ce7415f14bf16a62331671e4453bc119ea66a79ff7de8ce16408de6bc9c52a8608abd7e0b09646e58e0375b9f73ac4bf5c66ace82a09d3bd61160d77bb","ssdeep":"384:kLsyli2lLs4noTibgFQOKaG3ZHUIrS1+gZywygBNShjanzyMmz2XbNYpkP+s+n2t:YlHoEaGpzrS11yhq8azyh2jQy","tlshash":"26d2b45599b47b02fdd20a3453d0aaeb421c2d6f47f2120cb86de94f339399b30af995","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:40:31.389021Z","times_seen":15,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/LOGO.png","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.007Z","timestamp":1786912679007,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /LOGO.png HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Apr 2026 11:28:25 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8375\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8375,"size_decoded":8660,"mime_type":"image/png","magic":"PNG image data, 1000 x 225, 8-bit gray+alpha, non-interlaced","md5":"3465888eb00c3a9af48992f8d511f06f","sha1":"389a635ccb33a60b46c98172dc8442853ee72e91","sha256":"415e9ce35bc953b831d5600e48b10d701a43dda2d9c0212aec45bd247783d116","sha512":"9dc40b81f99e5ae0cf0fb80224a4dbafebf66d55135956ed91cb5bba5ef62ecf6c3afe0a21c2ec5bb36d0649fed4e8a6e915e81813d9a11303dcb006499d3549","ssdeep":"192:iSjJknuEB/HMxzuwm/GJrdod7NZ1P0Z1n/jF4LVW/UU0D050J:9WnHs5XVrdod7NPAxj+LBF","tlshash":"1d02a0d63580ed45e92d6a570eded00e2b738384fed2e052bc47a44e39600b26d0eed6","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:40:31.387849Z","times_seen":10,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/ClarikaGrotesque-Medium.woff2","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.065Z","timestamp":1786912679065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /ClarikaGrotesque-Medium.woff2 HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Thu, 09 Apr 2026 11:28:22 GMT\r\naccept-ranges: bytes\r\ncontent-length: 32128\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":32128,"size_decoded":32415,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32128, version 1.0","md5":"212cd777ff9d6b02b0981b218d3ef0b1","sha1":"aa7d08b5d7e2aeaaca6820efc35a03f9d08da3a8","sha256":"9e5f6e7a0567646c68c006ca0f27cd689b4097cd6a739681479ab96541a91f18","sha512":"10bfb3090c16acdb3fd17201654c0b9c915e2a3ecacbbc002cf259e0b3443550b34e755d88fb097e401898e39718fbeeebe705c1c3fd0c68fa5309d3864bad87","ssdeep":"768:eFM1DA935+9xV6qrHM+eTDgL8WwQH/QFxxoORi7AEY:dEYxV6OGTK8Zu4F4q7","tlshash":"c8e2e12e27f00c615773937068bd3319c91c85cb4f837085e854e9ef69651a0b3ba9aa","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:40:31.381769Z","times_seen":15,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-16T20:37:58.554Z","timestamp":1786912678554,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 11:28:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1090\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":4853,"size_decoded":1399,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"f711e5716c2107256bcb1567af76fd84","sha1":"3a15fa8fe8b88a70b202ac061af151c8676c2c06","sha256":"4d344bec4149260ffd1bd49ff6543ae7361bdac7389ed8f41115217b2057d7c3","sha512":"a75f0f4998049fb2908fd9850e6cb3b1d69b8f1fbd2a377ceeaaad0e1a2b509035ee99e7a2f448a1cb18bba9d9e905195c5139e2f251bcba89c7f8c13015d39e","ssdeep":"48:0Wu8LAKghm+QPBpPeHt2YxNmUcpFm7dzCSvCxt/Fl8wx/mU86yTPVo02P5:GRQJpPeH9xNHcpFm7QPPtl8wBd8GB","tlshash":"f7a1ff5054924a6a01b348c82c265b5fff8a914feb561488b2ed63e73ff2c44cc73689","first_seen":"2026-06-04T06:00:31.188087Z","last_seen":"2026-08-16T20:40:31.382391Z","times_seen":5,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":164,"connect":20,"send":0,"wait":23,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/main.css","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.992Z","timestamp":1786912678992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /main.css HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 09 Apr 2026 11:28:25 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1148\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4659,"size_decoded":1477,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2171747938a5dc71f22773326f569560","sha1":"7326e4b4d391eb3fa280932e2b5c3823a246b13a","sha256":"301c0569098f8001efab5cac7c0faa69c6dd76686cc67128e8991e2dffc7868b","sha512":"d5cb69b173ac95bfbc7eb39092a88f327c9490a057e499a5d93327e4562dee777b91e3ee863a0494575407d3396d8960ae39bb796d13ec15db4064022c02cec0","ssdeep":"96:XeV8eVn2z8megJQ0zv4HMLM3lGhwH9t/lyNTM3I:tzAsUlGOn/lyNTM3I","tlshash":"f8a1f263fa92010251338654eb23ab3dbf6e541267020f767fed37292f979860da1b5c","first_seen":"2024-08-19T21:38:03.071036Z","last_seen":"2026-08-16T20:56:43.303199Z","times_seen":14,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/Robux.png","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.009Z","timestamp":1786912679009,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /Robux.png HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Apr 2026 11:28:27 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9978\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9978,"size_decoded":10263,"mime_type":"image/png","magic":"PNG image data, 192 x 220, 8-bit/color RGBA, non-interlaced","md5":"2daf0913de8cce602847c7a606ba5c98","sha1":"da59c685c32decfe3ca3a025b77da6953f217b19","sha256":"5f752a91358a17c79671dd8d564f706000bb7b7706220c3cf25b7ee39de72363","sha512":"b74db3c647058b56351c65b186cae75fee14ba729e4704dcecbd46871b4d70cfac6460d846f37ee937757e16312f1a44e127d454f871ad3c1d0b0cab11cde3d8","ssdeep":"192:/Rt8dXVcDxKEvmTfMLDFgakI7dvpCLUiKrZeeesX3cB30JPH+a+98:Zt8sDHvmzICI7dvtFrZLkYPH+98","tlshash":"8822afb8f6e29c9d9c4acc4ce20c597330fd1e2e6bb02695361dc4b15249c617da9ca9","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:40:31.388465Z","times_seen":10,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/favicon.ico","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.093Z","timestamp":1786912679093,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: image/x-icon\r\nlast-modified: Thu, 09 Apr 2026 11:28:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 523\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":525,"size_decoded":855,"mime_type":"image/x-icon","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"68208984e7e1dd87ab5f7c7d587c7a9b","sha1":"e1257a0d3863d707eb3dda6953068a1ab257585a","sha256":"1cb7faf06f9d66b671a030ad6a5927119bddfc43fa473b9b9dae463f8175da43","sha512":"6d88db780d7f68ac2d0f5828c001f0aec778e990ef95cbc007320b7ecc5cee76c3db4e74813eb8ed3dd85ab98b130f01ec916229b0050166cc222ae9ee2f707c","ssdeep":"","tlshash":"b3f075d3b6c0f6a1d4634113fce2c110559391780902c0a58451fee58bf87da40f0431","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:56:43.300404Z","times_seen":174,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/bootstrap.min.css","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.989Z","timestamp":1786912678989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /bootstrap.min.css HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 09 Apr 2026 11:28:20 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 20941\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":155758,"size_decoded":21271,"mime_type":"text/css","magic":"ASCII text, with very long lines (65324)","md5":"a15c2ac3234aa8f6064ef9c1f7383c37","sha1":"6e10354828454898fda80f55f3decb347fd9ed21","sha256":"60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36","sha512":"b435cf71a9ae66c59677a3ac285c87ea702a87f32367fe5893cf13e68f9a31fca0a8d14f6a7d692f23c5027751ce63961ca4fe8d20f35a926ff24ae3eb1d4b30","ssdeep":"1536:b/xImT+IcCQYYDnDEBi83NcuSEk/ekX/uKiq3SYiLENM6HN26F:b/Riz7G3q3SYiLENM6HN26F","tlshash":"68e386a6f5a0312de4a7c61964d0bafe156f8145d7220bfbf8273b7447892c70a63e4c","first_seen":"2023-04-05T08:00:04Z","last_seen":"2026-08-16T21:52:41.467995Z","times_seen":44467,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/countUp.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:58.998Z","timestamp":1786912678998,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /countUp.js HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Apr 2026 11:28:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2230\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7545,"size_decoded":2573,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"ef08adac1bb93886318d9d5f458c9d70","sha1":"927214beec9cad5b22f6e92a6728deef20baf02e","sha256":"f662ddd0dc42f44d4bcc8b9b3916f7cfacbc867c255e2350067bcfc4a195ff46","sha512":"943d2a5b604db3d347105f82e0c5dd4680e64a1f50800b1bd33c23e89eaff52918d3c232b64d9853e7af107546bf467fb1a3dc4a8a52538ae7aeb1eab0a4e6c0","ssdeep":"96:o7/gu+j0EoMLuGQG2+xjDvGSkaT9ywZHW3F4LYrIFU4/2BN53I7Mxuvow0wfOM+6:M3+jDuSkaTPMeU3kgmfOOFL","tlshash":"88f195d5a75b22625a5333678c1f13cb263c8272389e1defecbb0294185402b5386ef9","first_seen":"2023-03-07T01:06:27Z","last_seen":"2026-08-16T20:56:43.298141Z","times_seen":120,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/main.js","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.000Z","timestamp":1786912679000,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Apr 2026 11:28:25 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1223\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5878,"size_decoded":1566,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"cdd3001c196b4b25d96f6d421898f1cf","sha1":"072f30f12f3b1fa0e625e0ad36cd870004e28ab5","sha256":"2518b3ec31bcad537e8f4a6dfc955e16292dd1481c7ae092b825abcdae03dca4","sha512":"11f0356d959f8d9a0d2399cfeac5624d3a14ec08e63a249402652d2733b5912375a532d8cd9559570c8eebdabbb037b3d5f301be7956ce1f6eb0dccf2c6ff644","ssdeep":"96:7S7+TfTZDfzCN3OSVOM53OSVCfCnJpk2Axc2kxc2a:7gMSVmaJpkLxc1xcb","tlshash":"7cc1ac0cf9011a1b4a3337e58d1b461eeb78627ff0164ed0b6de98e41f39155a332e9a","first_seen":"2024-08-19T21:38:03.085732Z","last_seen":"2026-08-16T20:40:31.381105Z","times_seen":10,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblxhelper.co/ClarikaGrotesque-Regular.woff2","fqdn":"rblxhelper.co","domain":"rblxhelper.co","tld":"co"},"ip":{"addr":"77.81.120.24","port":443,"asn":200514,"as":"KnownSRV Ltd.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rblxhelper.co/","date":"2026-08-16T20:37:59.064Z","timestamp":1786912679064,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.rblxhelper.co","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 09 Aug 2026 22:01:43 GMT","end":"Sat, 07 Nov 2026 22:01:42 GMT"},"fingerprint":{"sha1":"D0:DC:9B:67:1E:F0:3C:45:9E:56:76:48:42:FA:AE:0F:BD:EC:88:4D","sha256":"4F:F2:E6:B6:76:92:27:22:10:AC:E5:D4:01:4E:5D:30:00:4E:D1:51:1A:3C:F8:F7:6F:11:1B:3E:A0:B7:2C:7F"}}},"request":{"raw":"GET /ClarikaGrotesque-Regular.woff2 HTTP/1.1\r\nHost: rblxhelper.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rblxhelper.co/main.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 23 Aug 2026 20:37:59 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Thu, 09 Apr 2026 11:28:23 GMT\r\naccept-ranges: bytes\r\ncontent-length: 32368\r\ndate: Sun, 16 Aug 2026 20:37:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":32368,"size_decoded":32655,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32368, version 1.0","md5":"03e2aed67dca8a2c6f65de2ab2f6dd88","sha1":"a12a8b055ab778f975fcea3402a87ebd515eabe5","sha256":"e43239ea9a2b7f60b62a5963e42b92a73609d20c37ee33964f6e8cb65a66195b","sha512":"690c10e26c2ebed065e019815ec14acc3339a9a80952c72a3cf89ffc22df70663b77bbed07dc668714c7f1af51253ac3f2bc20998aad7a504d2eadcedfa871d0","ssdeep":"768:ewUN1Ys2TR2AkBSPlFOPZuSk83V2EgkXthP7HVpWG8N3:f0AkB5uS3Ftp7Hp8N3","tlshash":"5fe2f1d945eba9c1ffd0a1f703268e1bd3e53324168109a536b43bd0dda2c24b3699bd","first_seen":"2023-06-19T00:28:49Z","last_seen":"2026-08-16T20:56:43.299706Z","times_seen":20,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"rblxhelper.co","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"rblxhelper.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}