Singer: A dynamic analysis of 107,615 Roblox script listings from public script sites

Between 8 and 11 November 2026 we ran every script listed on ScriptBlox and Rscripts through Singer, the test environment Scriptsight uses to check every script on RoScripts: 105,221 listings. On 13 November we did the same for the 2,394 robloxscripts.com listings that served code. That makes 107,615 listings in all, the total of the table below. We wanted to know how often a script does something to the person running it that they didn’t ask for.

What we found

208 scripts tried to take something from the player running them. Between them, their listings had been viewed more than 3.9 million times. 128 tried to trade or send the player’s in-game items to another account named in the script. 80 copied a link to a website made to look like Roblox.

Site	Listings tested	Listings that stole or phished	Views on those listings
ScriptBlox	64,117	127	about 407,000
Rscripts	41,104	140	about 3.5 million
robloxscripts.com	2,394	5	377

Rscripts’ 140 listings are 76 distinct scripts: some were uploaded more than once.

9,195 scripts (9.3%) sent some information about the player, such as their username, to a server outside Roblox, mostly to a key system or a usage counter. Both are common in Roblox scripts, and we don’t count them above.

Is ScriptBlox safe?

Of the 64,117 ScriptBlox listings we tested, 127 tried to steal from the player or send them to a fake Roblox site: about one in 500. 70 of them targeted the player’s items and 57 copied a fake Roblox link.

We sent ScriptBlox the list on 12 November. By 13 November, ScriptBlox had removed all 127.

Is Rscripts safe?

Of the 41,104 Rscripts listings we tested, 140 tried to steal from the player or send them to a fake Roblox site: about one in 300. Those listings had about 3.5 million views between them, more than any other site we tested. Rscripts showed its own risk warning on 7 of them. The other 133, with about 3.2 million views, carried no warning.

We sent Rscripts the list on 12 November. By 13 November, Rscripts had removed all 140, and asked us to include this statement:

Every Rscripts listing in this report has been removed. All but one were uploaded before 2 November, when we rebuilt how scripts get onto the site: new uploads need a verified Discord account, every upload and edit is scanned, and anything serious stays offline until an admin has checked it. We’re looking into how the one newer listing got through. We’re still working through older scripts, and reports like this one help. Details: rscripts.net/blog/what-we-changed-about-stealers

Is robloxscripts.com safe?

Of the 2,394 robloxscripts.com listings we tested, 5 tried to send the player’s items to another account: about one in 480. They had 377 views and 3,280 runs between them. Four named the receiving account in their settings. The fifth sent the player’s inventory and server to an item-stealing service.

We sent robloxscripts.com the list on 13 November, and all 5 were removed the next day.

How we tested

Each script ran in Singer, an isolated environment that behaves like a Roblox game and a script executor. Singer records what a script does: what it downloads, what it sends and where, and what it tries to do with the player’s account and items. No script ran on a real Roblox account, and no real player’s information was used.

On 11 November we ran every flagged script a second time, on a newer version of Singer. The figures above count only the results that run confirmed.

robloxscripts.com lists 9,147 scripts. 6,753 of them, almost all imported from elsewhere, returned “Script not found” instead of code and weren’t tested. We ran the other 2,394 listings on 13 November, on a newer version of Singer than the ScriptBlox and Rscripts tests, and ran each flagged script at least twice. Two scripts over 1 MB couldn’t be run.

What we have done

Before publishing this post, we sent ScriptBlox, Rscripts and robloxscripts.com the full list of affected listings, with what each script did. By 14 November, all three had removed every listing on it. Scripts on all three sites are uploaded by their users. Every listing we found is in the table at the end of this post, with its status on the date shown.

How to stay safe

Roblox’s own pages are on roblox.com. An address that adds an ending after it, or spells it slightly differently, is not Roblox, even when the page looks the same. Don’t sign in there.

A script has no reason to trade, gift or mail your items. If a trade opens that you didn’t start, decline it.

Be careful with any script that asks you to visit a website or join a group before it works.

Scripts on RoScripts

Every script on RoScripts runs in Singer when it is uploaded, and again whenever its code changes. A script Singer catches taking items or sending players to a fake Roblox site is removed. Read more about Scriptsight.