⠀⠀⠀⡎⢉⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⢈⣁⠆⡀⠀⠀⠀⠀⣄⠀⠀
⠀⠀⠀⢳⢹⠁⠀⠱⡀⠀⠀⢈⠆⠀
⠀⠀⠀⠠⢾⣆⠀⠞⠁⠀⣠⠮⡤⡀
⠀⠀⠀⠀⠐⠹⢦⡀⠀⠰⠁⡀⢰⡁
⠀⠀⠀⢔⠞⠛⠶⣟⣦⣀⠀⠀⠛⠀
⠀⠀⠀⠌⣤⡴⠀⠀⠀⠉⠳⡰⡡⠄
⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⡀⠹⡄⠀
⠀⠀⠀⠀⠀⠀⠀⠀⡇⢄⠙⢀⢷⢁
⠀⠀⠀⠀⣀⣄⡀⠀⠑⠀⠀⠊⣸⢰        ~ 𝙈𝙖𝙙𝙚 𝙗𝙮 𝙛𝙖𝙣𝙩𝙤𝙣𝙚𝙩𝙬𝙤𝙧𝙠
⠀⠀⠀⡔⠁⠠⠗⠀⠀⠀⠀⠀⡭⠄
⠀⠀⠀⢣⠀⠀⠲⣄⣀⣀⢤⡾⠁⠀
⠀⠀⠀⠀⠑⠢⠀⠀⢠⣴⣟⠍⠀⠀
⠐⠄⠄⠤⢐⡢⣀⡼⡾⠋⠀⠀⠀⠀
⠀⠀⢀⠔⣡⣞⠏⠀⠀⠀⠀⠀⠀⠀
⠀⠔⢡⠞⠁⡎⠀⠔⠒⡄⠀⠀⠀⠀
⡎⢰⠃⠀⠀⡗⠄⠁⣀⠆⠀⠀⠀⠀
⠀⠁⢀⠃⠀⠣⡀⠀⠀⠀⠀⣥⠀⠱
⠀⠀⡂⢧⡀⠐⢌⣀⠀⠀⢀⡠⢠⢀
⠀⠀⠂⠀⠁⠀⠀⢐⠩⣏⣋⡸⠗⠊
⠀⠀⠀⠀⠀⠈⠉⡆⢡⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠑⠤⠔⠁⣸⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠥⠃⠀⠀⠀⠀







╔══════════════════════════════════════════════════════════════════════════════════════╗
║                    DOXBIN ARCHIVE // ENTRY: ROBLOX-PRORECREATION                     ║
║                           [ CONFIDENTIAL LEAK ]                                      ║
╚══════════════════════════════════════════════════════════════════════════════════════╝

┌─────────────────────────────────────────────────────────────────────────────────────┐
│ 0x01 [ SUBJECT PROFILE ]                                                            │
└─────────────────────────────────────────────────────────────────────────────────────┘
ALIAS:          Ale De
HANDLE:         ProRecreation (Roblox / X)
OTHER AKAS:     Adele, Addie, Ale de
THEAT LEVEL:    MODERATE (Social Engineering)
STATUS:         ACTIVE / MONITORED

ANALYST NOTE:
The subject is a known "trust trader" who operates within Roblox development circles.
Unlike mass-phishing bots, this actor manually targets developers, building rapport
before deploying malicious payloads. The subject is classified as a "Script Kiddie"
due to poor OPSEC (no VPN) and reliance on pre-made malware tools.

┌─────────────────────────────────────────────────────────────────────────────────────┐
│ 0x02 [ INFRASTRUCTURE & GEO-LOCATION ]                                            │
└─────────────────────────────────────────────────────────────────────────────────────┘
ISP:            Optimum Online (Cablevision Systems Corp.)
ASN:            AS6128
IP V4:          68.193.8.167
HOSTNAME:       ool-44c108a7.dyn.optonline.net
CONNECTION:     Dynamic Residential Cable (DOCSIS)

LOCATION DATA:
─────────────────────────────────────────────────────────────────────────────────────
Country:        United States (US)
State:          New York (NY)
City/Metro:     Bronx / New York City Metro Area
Zip Code:       [Estimated: 104xx Range]
Coordinates:    40.83° N, 73.86° W
Timezone:       America/New_York (EST)

RISK ASSESSMENT:
The IP is a standard residential connection. No VPN, Proxy, or Datacenter hosting
is detected. This implies the subject operates from a home environment in the Bronx
area, likely a teenager or young adult using a family internet connection. This makes
identification via ISP subpoena trivial if legal action is pursued.

┌─────────────────────────────────────────────────────────────────────────────────────┐
│ 0x03 [ TACTICS, TECHNIQUES & PROCEDURES (TTPs) ]                                 │
└─────────────────────────────────────────────────────────────────────────────────────┘
PRIMARY VECTOR: Social Engineering + Malware Distribution.

STAGE 1: INITIATION
─────────────────────────────────────────────────────────────────────────────────────
• Subject infiltrates Discord servers or follows target devs on Twitter/X.
• Initiates conversation regarding Lua scripting, building, or game mechanics.
• Establishes "credibility" by sharing basic code snippets or offering "help."

STAGE 2: THE HOOK
─────────────────────────────────────────────────────────────────────────────────────
• Proposes a collaboration or asks the victim to "test" a custom plugin/tool.
• Often claims the file is a "Roblox Studio Plugin" (.rbxm) or a texture pack.
• Uses urgency or flattery to lower victim defenses ("I need your expert opinion").

STAGE 3: EXECUTION
─────────────────────────────────────────────────────────────────────────────────────
• Delivers a file via Discord file transfer or a shady file host (e.g., Transfer.sh).
• File is typically an executable (.exe, .bat) or a script containing a webhook.
• Payload:
    - Cookie Stealers (targets .ROBLOSECURITY file).
    - Discord Token Grabbers.
    - Generic Remote Access Trojans (RATs).

STAGE 4: EXFILTRATION
─────────────────────────────────────────────────────────────────────────────────────
• Victim executes file.
• Credentials are sent to the subject's Discord webhook or private server.
• Subject drains account (Robux, Limiteds) or locks the victim out.

┌─────────────────────────────────────────────────────────────────────────────────────┐
│ 0x04 [ PLATFORM PRESENCE ]                                                         │
└─────────────────────────────────────────────────────────────────────────────────────┘
Platform    Username        Notes
─────────────────────────────────────────────────────────────────────────────────────
Roblox      ProRecreation   Primary account used for scamming.
Twitter/X   [Unknown]       Likely used for DMing developers.
Discord     [Varies]        Changes IDs frequently to avoid bans.

═══════════════════════════════════════════════════════════════════════════════════════
// END OF LEAK