Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Roblox with extras! - RoBox

CRITICAL RISKRemoved from Chrome Web Store

Roblox with extras! - RoBox

ID: cfllfglbkmnbkcibbjoghimalbileaic

Could be malicious

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.1.2

Size

0.45 MB

Rating

4.8/5

Reviews

929

Users

1,000,000

Type

Extension

Updated

Sep 16, 2024

Publisher Contextual Analysis

Trusted

Author: tammkihosresView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,000,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Play and trade with the best Roblox tools! Take your Roblox experience to a whole new level!

Introducing a powerful and user-friendly tool designed specifically for Roblox players, offering quick and seamless access to the Roblox website and its extensive range of features. With this extension, players can easily navigate to their profile, explore the leaderboard, and stay updated on what their friends are playing. The tool provides a streamlined experience, allowing users to quickly join games, engage in chats with other players, and effortlessly purchase Robux, the in-game currency that fuels the Roblox economy. Elevate your Roblox experience and become a true professional user with our tool, which enhances your gameplay by providing detailed game statistics on your favorite titles. This extension stands out as one of the few that can calculate the revenue generated by games on Roblox, giving you valuable insights into the platform's thriving ecosystem. We're constantly working to bring you even more innovative features, so stay tuned for future updates that will further enhance your Roblox experience. RoBox's expansion operates at a deep level within the Roblox environment, unlocking a variety of features that were previously hidden by game developers or lost due to platform updates. This powerful expansion opens up new possibilities for gamers, allowing them to rediscover and enjoy their favorite games with fresh content and enhanced functionality. Whether it's accessing features that were once unavailable or reclaiming those that were removed, RoBox's expansion ensures that your gaming experience is richer, more immersive, and more enjoyable than ever before. You have an exclusive option to set unique custom cursor to use on every website. RoBox cooperates with Natutti LTD By installing our extension you agree to our internal policy and also automatically agree to the Privacy Policy and Terms of Use of the Natutti platform https://natutti.net/privacy-policy.html https://natutti.net/terms-of-use.html

User Growth

Showing data from Jan 18, 2023 to Jan 17, 2024

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 894 ratings+1 (0%)

Average Rating

Current: 4.85 / 5.0+4.85

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium3

Low0

Versions scanned

Showing 2 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.1 Code review	3
0.0.1 Code review	8

Extension Version	Code Review Findings
1.1.1	3
0.0.1	8

Files with findings

7 distinct paths — top paths by unique finding count:

background/bg.js3
serviceWorker/userTracker.js3
app/main/adblock.js1
app/shared/sharedData.js1
inject.js1
serviceWorker.js1
settings/content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	serviceWorker/userTracker.js (line 1)	The extension contacts an unrelated third-party domain (`dolaretrey.com`) at three endpoints: `/api/action/`, `/api/config/`, and `/uninstall/`. It generates a persistent unique user ID (UID), then base64-encodes a JS…	0.0.1
2	Network Interception	critical	background/bg.js (line 107)	Every time a tab URL changes, the extension sends that destination to `abmitad.com` and accepts a replacement URL from the response. It then rewrites the user’s tab to the returned address, which is consistent with tr…	1.1.1
3	Remote Code Loading	critical	serviceWorker/userTracker.js (line 1)	The `updateConfig()` method POSTs a base64-encoded beacon (containing extension ID, version, timestamp, and UID) to `dolaretrey.com/api/config/` and then writes every key in the server's JSON response directly into `t…	0.0.1
4	Credential Theft	high	serviceWorker.js (line 1)	The service worker exposes a general-purpose `fetch` proxy to all content scripts that transparently harvests, caches, and auto-rotates Roblox CSRF tokens (`X-CSRF-TOKEN`). While ostensibly used for authenticated API …	0.0.1
5	Phishing	high	background/bg.js (line 8)	This sends install/update action telemetry, including a persistent UID, to a third-party domain (`suppjacob.com`). More importantly, it blindly opens any URL returned by that server, giving the remote operator a way t…	1.1.1
6	Phishing	high	settings/content.js (line 1)	The `settings/content.js` content script runs on `<all_urls>` (every website the user visits, not just roblox.com), on every frame, at `document_idle`. It listens for a `insertGame` runtime message and responds by inj…	0.0.1
7	Tracking	high	background/bg.js (line 56)	The extension creates and persists its own unique identifier, then sends that identifier with extension metadata and timestamps to a remote server. This is a tracking pattern, and the same UID is also tied into uninst…	1.1.1
8	Tracking	high	serviceWorker/userTracker.js (line 1)	On every `install` and `update` lifecycle event, the extension queues an action beacon sent to `dolaretrey.com` with an encoded payload carrying the user's persistent UID, extension ID, version, and timestamp. The uni…	0.0.1
9	Code Injection	medium	inject.js (line 15)	The injected page script wraps React's `createElement` and `useState` at the prototype level using `Proxy`, intercepting every component render and every state update across the entire Roblox web application. The same…	0.0.1
10	Network Interception	medium	app/shared/sharedData.js (line 1)	The extension repurposes the `declarativeNetRequest` API (granted via `declarativeNetRequestWithHostAccess`) to create a dynamic redirect rule that maps `roblox.com/btr/settings` to a `data:` URL containing a JSON blo…	0.0.1
11	Other	medium	app/main/adblock.js (line 1)	The adblock module uses a `MutationObserver` to intercept inline `<script>` tags at DOM insertion time. When it finds Roblox's `EventStream.Init` script, it replaces every quoted string argument with empty strings usi…	0.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


privatemessages.roblox.com	/v1/messages/unread/count	https://privatemessages.roblox.com/v1/messages/unread/count
privatemessages.roblox.com	/v1/messages	https://privatemessages.roblox.com/v1/messages?pageSize=20&messageTab=Inbox&pageNumber=
privatemessages.roblox.com	/v1/messages/mark-read	https://privatemessages.roblox.com/v1/messages/mark-read
www.roblox.com	/places/version-history	https://www.roblox.com/places/version-history?assetID=${e}&page=${t}`;d.push(fetch(s
www.roblox.com	/places/revert	https://www.roblox.com/places/revert
assetdelivery.roblox.com	/v1/asset/	https://assetdelivery.roblox.com/v1/asset/?id=${e}&version=${r}`;AssetCache.loadBuffer(i,(e=
groups.roblox.com	/v2/groups/$%7Bt.groupId\|\|e.library.currentGroup.id%7D/wall/posts	https://groups.roblox.com/v2/groups/${t.groupId\|\|e.library.currentGroup.id}/wall/posts?sortOrder=Desc&limit=100&cursor=${n}`;let
api.roblox.com	/users/$%7Be%7D/onlinestatus/%60	https://api.roblox.com/users/${e}/onlinestatus/`
www.roblox.com	/Games/shutdown-all-instances	https://www.roblox.com/Games/shutdown-all-instances
groups.roblox.com	/v1/users/$%7Be%7D/groups/roles%60;$.fetch(t	https://groups.roblox.com/v1/users/${e}/groups/roles`;$.fetch(t

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


20.3.1.5	IPv4	-
3.8.2.2	IPv4	-
20.3.2.5	IPv4	-
4.5.2.7	IPv4	-
202.9.3.2	IPv4	-
201.1.5.5	IPv4	-
1.9.6.8	IPv4	-
202.2.8.8	IPv4	-
204.6.1.4	IPv4	-
201.3.6.2	IPv4	-
3.3.4.7	IPv4	-
1.3.2.6	IPv4	-
20.5.3.9	IPv4	-
20.6.2.8	IPv4	-
2.2.5.4	IPv4	-
1.9.1.3	IPv4	-
20.2.1.4	IPv4	-
206.5.1.4	IPv4	-
206.5.1.3	IPv4	-
20.5.1.7	IPv4	-
3.2.5.5	IPv4	-
3.3.4.8	IPv4	-
20.8.2.9	IPv4	-
202.5.2.4	IPv4	-
20.5.1.8	IPv4	-
2.2.3.4	IPv4	-
3.2.7.2	IPv4	-
2.2.5.3	IPv4	-
2.3.5.6	IPv4	-
2.1.3.2	IPv4	-
20.2.1.3	IPv4	-
7.5.1.9	IPv4	-
5.1.9.6	IPv4	-
5.2.7.8	IPv4	-
201.9.4.8	IPv4	-
203.2.4.4	IPv4	-
1.1.1.1	IPv4	-
203.9.4.4	IPv4	-
1.1.2.2	IPv4	-
3.2.1.1	IPv4	-
20.4.4.4	IPv4	-
3.2.4.5	IPv4	-
20.2.2.3	IPv4	-
20.4.1.6	IPv4	-
4.2.6.5	IPv4	-
2.3.2.6	IPv4	-
4.1.7.4	IPv4	-
3.1.5.4	IPv4	-
1.4.5.8	IPv4	-
206.4.1.3	IPv4	-
4.1.7.3	IPv4	-
3.2.7.3	IPv4	-
20.4.1.5	IPv4	-
3.1.5.2	IPv4	-
3.4.4.4	IPv4	-
2.1.4.2	IPv4	-
20.3.1.6	IPv4	-
3.8.1.1	IPv4	-
2.2.3.5	IPv4	-
9.5.1.9	IPv4	-
204.6.4.4	IPv4	-
201.7.4.3	IPv4	-
2.4.1.8	IPv4	-
20.8.2.2	IPv4	-
2.4.5.4	IPv4	-
205.6.8.4	IPv4	-
2.3.2.7	IPv4	-
20.7.2.9	IPv4	-
5.2.3.2	IPv4	-
20.6.1.8	IPv4	-
20.8.3.9	IPv4	-
5.3.5.8	IPv4	-
1.2.1.3	IPv4	-
1.3.1.5	IPv4	-
1.5.5.8	IPv4	-
8.5.1.9	IPv4	-
1.4.107.8	IPv4	-
195.8.8.6	IPv4	-
20.4.2.7	IPv4	-
8.7.1.4	IPv4	-
2.2.4.5	IPv4	-
5.2.8.8	IPv4	-
201.4.9.2	IPv4	-
4.2.8.1	IPv4	-
2.3.5.5	IPv4	-
1.4.5.7	IPv4	-
20.3.1.7	IPv4	-
3.5.8.6	IPv4	-
2.5.6.8	IPv4	-
3.3.8.4	IPv4	-

Showing 1 to 90 of 90 rows

Rows per page:

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I. like the. roblox mommy. like. roblox

Meshell Thompson·16 Jan 2025

esta bien la verdad

pou salchipapasGDMC·4 Jan 2025

it works btw, but it is very confusing to use.

Divine Rebel·8 Dec 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Roblox with extras! - RoBox

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating