{"passed":{"encryption":[{"id":"ssl_cert_revoked","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"SSL > Revoked","value":"false"}],"actual":[{"property":"SSL > Revoked","value":"false"}],"severity":5,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Certificate not found on our revoked certificate list","description":"The site's certificate chain was checked against our list of revoked certificates.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active. Certificates may be revoked before their expiration date for several reasons, including a compromised private key or decommissioned domain.","riskDetails":"A revoked certificate is invalid and does not provide proper SSL/TLS protection. Revoked certificates are also untrusted in most browsers, rendering the site inaccessible. One of the main reasons a certificate would be revoked is that the private encryption key has been compromised. This means a malicious actor would be able to impersonate the recipient with the private key and decrypt the data.","recommendedRemediation":"Revoked certificates should be immediately replaced by new, valid certificates from a trusted authority. This will ensure the continuity of encrypted communications between affected servers and their clients. Certificates should be regularly audited to ensure no revoked certificates are in use.","knownExploitedVulnCount":0,"checkID":"ssl_cert_revoked","category":"ssl","controlCheckID":"IM.EN.TC.UQ","passTitle":"Certificate not found on our revoked certificate list","passDescription":"The site's certificate chain was checked against our list of revoked certificates.","passGroupDescription":"No sites were found to be using revoked certificates.","failTitle":"Revoked certificate in use","failDescription":"The TLS certificate chain presented by the web server contains a revoked certificate.","remediation":"Install a new certificate.","issue":"SSL certificates have been revoked prior to their scheduled expiration date. This means the certificate is no longer trusted and visitors may not be able to connect to the website.","recommendation":"Install a new SSL certificate on all impacted domains to prevent errors being shown to the end-user. This ensures communications remain secure between the server and visitors.","defaultSeverity":5,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active. Certificates may be revoked before their expiration date for several reasons, including a compromised private key or decommissioned domain.","RiskDetails":"A revoked certificate is invalid and does not provide proper SSL/TLS protection. Revoked certificates are also untrusted in most browsers, rendering the site inaccessible. One of the main reasons a certificate would be revoked is that the private encryption key has been compromised. This means a malicious actor would be able to impersonate the recipient with the private key and decrypt the data.","RecommendedRemediation":"Revoked certificates should be immediately replaced by new, valid certificates from a trusted authority. This will ensure the continuity of encrypted communications between affected servers and their clients. Certificates should be regularly audited to ensure no revoked certificates are in use."},{"id":"ssl_enabled","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"SSL","value":"true"}],"actual":[{"property":"SSL","value":"true"}],"severity":5,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL available","description":"SSL is supported for this site.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:80","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary.","riskDetails":"Without SSL, all communications between systems are sent in plain text. This plain text can then be intercepted by a third party in what is called a man-in-the-middle (MITM) attack. These attacks target and harvest credentials and other sensitive information, which can in turn be used for further malicious activity. Improperly configured SSL/TLS and certificates that are out of date or encrypted with weak algorithms do not provide the necessary protection to prevent MITM attacks, and will make the site unreachable in most browsers.","recommendedRemediation":"Valid SSL/TLS certificates with strong encryption algorithms should be obtained from a trusted authority and properly installed and configured on all internet facing systems. Every system must have its name on the certificate to prevent mismatch errors in the browser. HTTPS should be made mandatory, with the necessary redirects and enforcement in place to ensure no plain text connections are possible. Processes should be established to ensure certificates are renewed before they expire.","knownExploitedVulnCount":0,"checkID":"ssl_enabled","category":"ssl","controlCheckID":"IM.EN.DT.PA","passTitle":"SSL available","passDescription":"SSL is supported for this site.","passGroupDescription":"SSL is supported on all sites.","failTitle":"SSL not available","failDescription":"SSL is the standard encryption method for browsing websites. Enabling SSL requires installing an SSL certificate on the site.","remediation":"Install SSL certificates.","issue":"We've detected websites that lack a valid SSL certificate. Without SSL, website visitors and customers are at higher risk of having their data stolen through man-in-the-middle and other cyber attacks.","recommendation":"Install valid SSL certificates on affected domains. Websites without valid SSL certificates are shown as 'non-secure' in modern browsers and will rank worse in Google and other search engines.","defaultSeverity":5,"categoryTotalCost":29,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary.","RiskDetails":"Without SSL, all communications between systems are sent in plain text. This plain text can then be intercepted by a third party in what is called a man-in-the-middle (MITM) attack. These attacks target and harvest credentials and other sensitive information, which can in turn be used for further malicious activity. Improperly configured SSL/TLS and certificates that are out of date or encrypted with weak algorithms do not provide the necessary protection to prevent MITM attacks, and will make the site unreachable in most browsers.","RecommendedRemediation":"Valid SSL/TLS certificates with strong encryption algorithms should be obtained from a trusted authority and properly installed and configured on all internet facing systems. Every system must have its name on the certificate to prevent mismatch errors in the browser. HTTPS should be made mandatory, with the necessary redirects and enforcement in place to ensure no plain text connections are possible. Processes should be established to ensure certificates are renewed before they expire."},{"id":"http_available","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"HTTP Accessible","value":"false"}],"actual":[{"property":"HTTP Accessible","value":"false"}],"severity":4,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"HTTP requests are redirected to HTTPS","description":"All HTTP requests are redirected to HTTPS.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:80","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"The HTTP Still Available check is used to measure whether a server is allowing users to connect to it via HTTP rather than HTTPS. Connecting to a website via HTTPS is more secure as it involves a SSL/TLS-based connection, which encrypts data in transit. Many web browsers will try the HTTP version of a website first before trying the HTTPS version. If you have a proper redirect response on your HTTP port then you will pass this check. You should combine this with proper HSTS settings to ensure browsers always attempt a HTTPS-based connection from the beginning.","riskDetails":"Encrypting data using SSL/TLS prevents any attackers who intercept the data from reading it. If any part of the connection transmits data using HTTP, even if it later uses HTTPS, the data transmitted over HTTP is susceptible to man-in-the-middle attacks. For example, a user might attempt to visit your website and embed their username and password in the URL parameters or the request headers as part of the request. Even if that data is then redirected to an HTTPS connection, it was still transmitted via HTTP.","recommendedRemediation":"All HTTP connections should be redirected to HTTPS connections instead. The method for doing this differs by technology. For some websites, the .htaccess file can be modified to reroute requests to HTTPS. For Microsoft IIS, the URL Rewrite module for IIS will allow you to redirect HTTP requests to HTTPS. HTTPS redirects should always be paired with HTTP Strict Transport Security (HSTS). HSTS will ensure no HTTP connections are allowed.","knownExploitedVulnCount":0,"checkID":"http_available","category":"ssl","controlCheckID":"IM.EN.DT.ZW","passTitle":"HTTP requests are redirected to HTTPS","passDescription":"All HTTP requests are redirected to HTTPS.","passGroupDescription":"All HTTP requests are redirected to HTTPS.","failTitle":"HTTP does not redirect to HTTPS","failDescription":"The domain is still accessible over HTTP. All HTTP requests should be redirected to HTTPS.","remediation":"Redirect HTTP requests to HTTPS.","issue":"Websites are still accessible over HTTP. All HTTP requests should be redirected to HTTPS to ensure encrypted communications between the website and its visitors.","recommendation":"Redirect users and search engines to the HTTPS page or resource with server-side 301 HTTP redirects. This ensures all communications are encrypted, preventing certain man-in-the-middle attacks.","defaultSeverity":4,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.2"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"The HTTP Still Available check is used to measure whether a server is allowing users to connect to it via HTTP rather than HTTPS. Connecting to a website via HTTPS is more secure as it involves a SSL/TLS-based connection, which encrypts data in transit. Many web browsers will try the HTTP version of a website first before trying the HTTPS version. If you have a proper redirect response on your HTTP port then you will pass this check. You should combine this with proper HSTS settings to ensure browsers always attempt a HTTPS-based connection from the beginning.","RiskDetails":"Encrypting data using SSL/TLS prevents any attackers who intercept the data from reading it. If any part of the connection transmits data using HTTP, even if it later uses HTTPS, the data transmitted over HTTP is susceptible to man-in-the-middle attacks. For example, a user might attempt to visit your website and embed their username and password in the URL parameters or the request headers as part of the request. Even if that data is then redirected to an HTTPS connection, it was still transmitted via HTTP.","RecommendedRemediation":"All HTTP connections should be redirected to HTTPS connections instead. The method for doing this differs by technology. For some websites, the .htaccess file can be modified to reroute requests to HTTPS. For Microsoft IIS, the URL Rewrite module for IIS will allow you to redirect HTTP requests to HTTPS. HTTPS redirects should always be paired with HTTP Strict Transport Security (HSTS). HSTS will ensure no HTTP connections are allowed."},{"id":"ssl_host_match","pass":true,"meta":"corp.roblox.com matches corp.roblox.com, www.corp.roblox.com matches www.corp.roblox.com","vendorOnly":false,"expected":[{"property":"SSL > Host Match","value":"[hostname matches SSL certificate]"}],"actual":[{"property":"SSL > Host Match","value":"corp.roblox.com matches corp.roblox.com, www.corp.roblox.com matches www.corp.roblox.com"}],"severity":4,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Hostname matches SSL certificate","description":"The site's hostname matches the SSL certificate.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Every certificate should include the preferred hostname(s) for the system that is being protected, so that the certificate can be verified to the address being accessed by the client.","riskDetails":"When a certificate does not match the hostname the client is trying to access, it produces an error in the browser. This is because each certificate must specify the addresses for which it is valid. In addition to sites being rendered inaccessible to most browsers, mismatched certificates open the door for man-in-the-middle (MITM) attacks, as name confusion reduces the trustworthiness of all systems involved.","recommendedRemediation":"A new certificate should be requested from a trusted authority with the correct hostname(s) listed on it. This will prevent browser errors and reduce certificate complexity across the organization. All existing certificates should be audited to ensure that each one has the proper hostnames. Changes to hostnames or aliases should include steps to update certificates with the new names.","knownExploitedVulnCount":0,"checkID":"ssl_host_match","category":"ssl","controlCheckID":"IM.EN.TC.PA","passTitle":"Hostname matches SSL certificate","passDescription":"The site's hostname matches the SSL certificate.","passGroupDescription":"All hostnames match their corresponding SSL certificates.","failTitle":"Hostname does not match SSL certificate","failDescription":"The site's hostname does not match the SSL certificate. The domain name should be added to the certificate, either as a Subject Alternative Name or as the Common Name.","remediation":"Set certificate Subject Alternative Name or Common Name correctly.","issue":"The hostname does not match the SSL certificate on the identified websites. This will result in modern browsers throwing an error and in some cases, refusing to connect to the website. This can also be a signal of an in-progress cyber attack.","recommendation":"Add the hostname to the SSL certificate, as a Subject Alternative Name or as Common Name, to ensure the website remains secure and does not expose errors to visitors through their browser.","defaultSeverity":4,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Every certificate should include the preferred hostname(s) for the system that is being protected, so that the certificate can be verified to the address being accessed by the client.","RiskDetails":"When a certificate does not match the hostname the client is trying to access, it produces an error in the browser. This is because each certificate must specify the addresses for which it is valid. In addition to sites being rendered inaccessible to most browsers, mismatched certificates open the door for man-in-the-middle (MITM) attacks, as name confusion reduces the trustworthiness of all systems involved.","RecommendedRemediation":"A new certificate should be requested from a trusted authority with the correct hostname(s) listed on it. This will prevent browser errors and reduce certificate complexity across the organization. All existing certificates should be audited to ensure that each one has the proper hostnames. Changes to hostnames or aliases should include steps to update certificates with the new names."},{"id":"ssl_expired","pass":true,"meta":"2027-01-08 23:59:59 UTC, 2027-03-18 23:59:59 UTC","vendorOnly":false,"expected":[{"property":"SSL > Expired","value":"[has not expired]"}],"actual":[{"property":"SSL > Expired","value":"2027-01-08 23:59:59 UTC, 2027-03-18 23:59:59 UTC"}],"severity":4,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL has not expired","description":"SSL certificate has not expired.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","riskDetails":"Expired SSL/TLS certificates can no longer provide encrypted channels for data, increasing the risk of a man-in-the-middle attack. Furthermore, most browsers will not allow access to sites with expired certificates, rendering them unavailable to most users.","recommendedRemediation":"Expired certificates must be replaced with valid certificates from a trusted authority. Once a valid certificate has been installed on the system, SSL/TLS functionality will be restored. Validity periods are limited to 398 days. In order to maintain continuity, processes should be established to renew certificates within that time frame before they expire.","knownExploitedVulnCount":0,"checkID":"ssl_expired","category":"ssl","controlCheckID":"IM.EN.DT.DQ","passTitle":"SSL has not expired","passDescription":"SSL certificate has not expired.","passGroupDescription":"No SSL certificates have expired.","failTitle":"SSL expired","failDescription":"SSL certificate has expired. The certificate will need to be renewed for connections to your domain to be trusted.","remediation":"Renew expired SSL certificates.","issue":"Websites have expired SSL certificates. SSL certificates facilitate the encryption of data in transit. When an SSL certificate expires, modern web browsers will issue a security warning that often results in visitors leaving the website.","recommendation":"Renew expired SSL certificates to ensure that the connections to the domain are secure and trust by modern browsers. This keeps your customers secure and ensures visitors don't bounce from your site.","defaultSeverity":4,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","RiskDetails":"Expired SSL/TLS certificates can no longer provide encrypted channels for data, increasing the risk of a man-in-the-middle attack. Furthermore, most browsers will not allow access to sites with expired certificates, rendering them unavailable to most users.","RecommendedRemediation":"Expired certificates must be replaced with valid certificates from a trusted authority. Once a valid certificate has been installed on the system, SSL/TLS functionality will be restored. Validity periods are limited to 398 days. In order to maintain continuity, processes should be established to renew certificates within that time frame before they expire."},{"id":"ssl_trusted_v2","pass":true,"meta":"Trusted SSL certificate","vendorOnly":false,"expected":[{"property":"SSL > Trusted","value":"true"}],"actual":[{"property":"SSL > Trusted","value":"true"}],"severity":4,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Trusted SSL certificate","description":"The certificate presented by this domain was issued by a trusted certificate authority.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":"ssl_trusted","summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Most certificates are issued from trusted authorities that are already allowed in most browsers. However, in certain circumstances, certificates can also be self-signed or issued by an untrusted authority.","riskDetails":"Untrusted certificates will cause an error in most browsers, preventing them from accessing the site. This is to ensure that only trustworthy certificates are accepted. Untrusted certificates could come from anywhere, and do not necessarily provide any guarantee of security. In some cases, untrusted certificates may be used internally in combination with the installation of client side certificates, but internet facing services should almost always use certificates from trusted third party authorities to provide a smooth end user experience.","recommendedRemediation":"Untrusted certificates should be replaced by valid certificates issued by trusted authorities. The untrusted certificate cannot be renewed. A new request must be generated by the affected system and submitted to the trusted authority. Intentional use of self-signed or untrusted certificates should be done with care to ensure both the accessibility and security of affected systems.","knownExploitedVulnCount":0,"checkID":"ssl_trusted_v2","category":"ssl","controlCheckID":"IM.EN.TC.ZW","passTitle":"Trusted SSL certificate","passDescription":"The certificate presented by this domain was issued by a trusted certificate authority.","passGroupDescription":"All responses contained a certificate issued by a trusted certificate authority.","failTitle":"Untrusted SSL certificate","failDescription":"The certificate presented by this domain was not issued by a trusted certificate authority and therefore cannot be verified by browsers.","remediation":"Configure the server to use a trusted SSL certificate.","issue":"Server responses contain untrusted SSL certificate. When the certificate is not trusted, web browsers will issue a security warning that often results in visitors leaving the website.","recommendation":"We recommend that you configure your server to use a trusted SSL certificate.","defaultSeverity":4,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Most certificates are issued from trusted authorities that are already allowed in most browsers. However, in certain circumstances, certificates can also be self-signed or issued by an untrusted authority.","RiskDetails":"Untrusted certificates will cause an error in most browsers, preventing them from accessing the site. This is to ensure that only trustworthy certificates are accepted. Untrusted certificates could come from anywhere, and do not necessarily provide any guarantee of security. In some cases, untrusted certificates may be used internally in combination with the installation of client side certificates, but internet facing services should almost always use certificates from trusted third party authorities to provide a smooth end user experience.","RecommendedRemediation":"Untrusted certificates should be replaced by valid certificates issued by trusted authorities. The untrusted certificate cannot be renewed. A new request must be generated by the affected system and submitted to the trusted authority. Intentional use of self-signed or untrusted certificates should be done with care to ensure both the accessibility and security of affected systems."},{"id":"http_strict_transport_security","pass":true,"meta":"[enforced by preload list]","vendorOnly":false,"expected":[{"property":"Headers > strict-transport-security","value":"[header set]"}],"actual":[{"property":"Headers > strict-transport-security","value":"[header set]"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"HTTP Strict Transport Security (HSTS) enforced","description":"With HSTS enforced, people browsing this site are less susceptible to man-in-the-middle attacks.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. HTTP Strict Transport Security (HSTS) ensures that no HTTP connections will be allowed from the server. This forces the use of HTTPS, which maintains encryption at all times.","riskDetails":"Without HSTS, servers are still allowed to establish unencrypted connections on the HTTP protocol. This can open the door for unexpected and unseen circumstances where a client passes sensitive information in plain text. HTTP to HTTPS redirects can still pass sensitive information, such as credentials in the URL, in plain text. This opens a window for a man-in-the-middle (MITM) attack. Old links that were overlooked might still specify HTTP. Users might create their own browser bookmarks using HTTP. As long as HTTP connections are possible, the risk of data interception is present.","recommendedRemediation":"Enable HSTS on the server. This is done by including the Strict-Transport-Security header on the system. The “includeSubDomains” directive should be specified to ensure all subdomains on the system use HTTPS. Submit your domain to Google’s HSTS preload service. This preload list is included in most browsers and will automatically make all connections to the domain use an encrypted channel.","knownExploitedVulnCount":0,"checkID":"http_strict_transport_security","category":"ssl","controlCheckID":"IM.EN.ET.PA","passTitle":"HTTP Strict Transport Security (HSTS) enforced","passDescription":"With HSTS enforced, people browsing this site are less susceptible to man-in-the-middle attacks.","passGroupDescription":"No sites detected as having missing HSTS settings.","failTitle":"HTTP Strict Transport Security (HSTS) not enforced","failDescription":"Without HSTS enforced, people browsing this site are more susceptible to man-in-the-middle attacks. The server should be configured to support HSTS.","remediation":"Set the Strict-Transport-Security header.","issue":"Websites are not enforcing HTTP Strict Transport Security (HSTS). Without enforcing HSTS, visitors are susceptible to certain man-in-the-middle attacks.","recommendation":"Configure the website to enforce HSTS by setting up the Strict-Transport-Security header, which ensures browsers will only communicate over HTTPS.","defaultSeverity":3,"categoryTotalCost":8,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. HTTP Strict Transport Security (HSTS) ensures that no HTTP connections will be allowed from the server. This forces the use of HTTPS, which maintains encryption at all times.","RiskDetails":"Without HSTS, servers are still allowed to establish unencrypted connections on the HTTP protocol. This can open the door for unexpected and unseen circumstances where a client passes sensitive information in plain text. HTTP to HTTPS redirects can still pass sensitive information, such as credentials in the URL, in plain text. This opens a window for a man-in-the-middle (MITM) attack. Old links that were overlooked might still specify HTTP. Users might create their own browser bookmarks using HTTP. As long as HTTP connections are possible, the risk of data interception is present.","RecommendedRemediation":"Enable HSTS on the server. This is done by including the Strict-Transport-Security header on the system. The “includeSubDomains” directive should be specified to ensure all subdomains on the system use HTTPS. Submit your domain to Google’s HSTS preload service. This preload list is included in most browsers and will automatically make all connections to the domain use an encrypted channel."},{"id":"ssl_chain_present","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"SSL > Chain","value":"[certificate chain present in server response]"}],"actual":[{"property":"SSL > Chain","value":"present"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL certificate chain present in server response","description":"A complete SSL certificate chain was presented by the server for this domain.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates belong to a “certificate chain” that provides validity at different levels. The Root certificate validates the issuer of the certificate, ensuring it actually came from that authority. There may also be intermediate certificates, depending on the structure and hierarchy of the issuer. Intermediate certificates provide an extra layer of security for the issuer to ensure the root keys are not compromised.","riskDetails":"Every certificate in the chain must be valid for the end certificate to be valid. Even if the end certificate is valid in itself, a missing root or intermediate certificate in the chain will invalidate the entire set. This is because the chain functions as a whole, with the validity of the end certificate being guaranteed by the validity of the issuer. Most browsers will encounter error messages when accessing websites with missing certificate chains, making them inaccessible to most users.","recommendedRemediation":"Servers should be configured to return the entire certificate chain. This problem often occurs when intermediate certificates need to be installed on the server in addition to the end certificate. This prevents gaps between the end certificate and the root authority. Ensure all necessary certificates in the chain are available on the system. Once they are, browsers will be able to access the system as normal. Certificates should be monitored or audited to ensure there are no chain gaps that could interrupt service.","knownExploitedVulnCount":0,"checkID":"ssl_chain_present","category":"ssl","controlCheckID":"IM.EN.TC.XG","passTitle":"SSL certificate chain present in server response","passDescription":"A complete SSL certificate chain was presented by the server for this domain.","passGroupDescription":"All server responses contained a complete SSL certificate chain.","failTitle":"SSL certificate chain missing from server response","failDescription":"There is an invalid or missing intermediate certificate. This can cause some browsers to break the padlock. An intermediate/chain certificate may need to be installed to link it to a trusted root certificate.","remediation":"Configure the server to include the certificate chain in the responses.","issue":"Server responses do not include the full certificate chain. When the certificate chain is missing, web browsers will issue a security warning that often results in visitors leaving the website.","recommendation":"We recommend that you configure your server to return the full SSL certificate chain.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates belong to a “certificate chain” that provides validity at different levels. The Root certificate validates the issuer of the certificate, ensuring it actually came from that authority. There may also be intermediate certificates, depending on the structure and hierarchy of the issuer. Intermediate certificates provide an extra layer of security for the issuer to ensure the root keys are not compromised.","RiskDetails":"Every certificate in the chain must be valid for the end certificate to be valid. Even if the end certificate is valid in itself, a missing root or intermediate certificate in the chain will invalidate the entire set. This is because the chain functions as a whole, with the validity of the end certificate being guaranteed by the validity of the issuer. Most browsers will encounter error messages when accessing websites with missing certificate chains, making them inaccessible to most users.","RecommendedRemediation":"Servers should be configured to return the entire certificate chain. This problem often occurs when intermediate certificates need to be installed on the server in addition to the end certificate. This prevents gaps between the end certificate and the root authority. Ensure all necessary certificates in the chain are available on the system. Once they are, browsers will be able to access the system as normal. Certificates should be monitored or audited to ensure there are no chain gaps that could interrupt service."},{"id":"ssl_expiry_chain","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"SSL > Chain","value":"[does not expire within 20 days]"}],"actual":[{"property":"SSL > Chain","value":"[none found]"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL chain certificates do not expire within 20 days","description":"SSL intermediate and root certificates do not expire within 20 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates belong to a “certificate chain” that provides validity at different levels. The Root certificate validates the issuer of the certificate, ensuring it actually came from that authority. There may also be intermediate certificates, depending on the structure and hierarchy of the issuer. Intermediate certificates provide an extra layer of security for the issuer to ensure the root keys are not compromised.","riskDetails":"A certificate in the chain will become invalid if its validity period expires. Every certificate in the chain must be valid for the end certificate to be valid. Even if the end certificate is valid in itself, an invalid root or intermediate certificate in the chain will invalidate the entire set. This is because the chain functions as a whole, with the validity of the end certificate being guaranteed by the validity of the issuer. Most browsers will not open websites with invalid certificate chains, making them inaccessible to most users.","recommendedRemediation":"Certificates with links in the chain that are about to expire must be reissued from a valid authority and replaced on the server. Certificate status should be monitored or regularly reviewed to ensure the validity status of the certificate chain.","knownExploitedVulnCount":0,"checkID":"ssl_expiry_chain","category":"ssl","controlCheckID":"IM.EN.DT.VG","passTitle":"SSL chain certificates do not expire within 20 days","passDescription":"SSL intermediate and root certificates do not expire within 20 days.","passGroupDescription":"All certificates in the SSL chain do not expire within 20 days.","failTitle":"SSL chain certificate expires within 20 days","failDescription":"An intermediate or root certificate expires within 20 days. When certificates expire they become invalid, and will no longer be able to run secure transactions.","remediation":"Renew SSL certificates.","issue":"Impacted domains have SSL intermediate or root certificates which are set to expire within 20 days. When certificates expire they become invalid, and will no longer be able to run secure transactions.","recommendation":"We recommend that you renew impacted SSL certificates prior to their expiry to avoid unencrypted communications. This helps keep your customers shape by ensuring adequate encryption.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Certificates belong to a “certificate chain” that provides validity at different levels. The Root certificate validates the issuer of the certificate, ensuring it actually came from that authority. There may also be intermediate certificates, depending on the structure and hierarchy of the issuer. Intermediate certificates provide an extra layer of security for the issuer to ensure the root keys are not compromised.","RiskDetails":"A certificate in the chain will become invalid if its validity period expires. Every certificate in the chain must be valid for the end certificate to be valid. Even if the end certificate is valid in itself, an invalid root or intermediate certificate in the chain will invalidate the entire set. This is because the chain functions as a whole, with the validity of the end certificate being guaranteed by the validity of the issuer. Most browsers will not open websites with invalid certificate chains, making them inaccessible to most users.","RecommendedRemediation":"Certificates with links in the chain that are about to expire must be reissued from a valid authority and replaced on the server. Certificate status should be monitored or regularly reviewed to ensure the validity status of the certificate chain."},{"id":"ssl_expiry_long","pass":true,"meta":"353, 393","vendorOnly":false,"expected":[{"property":"SSL > Expires","value":"[expiration period shorter than 398 days]"}],"actual":[{"property":"SSL > Expires","value":"353, 393"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL expiration period shorter than 398 days","description":"The SSL certificate presented by the server has an expiration period shorter than 398 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","riskDetails":"As of September 1 2020, the maximum supported validity duration for SSL/TLS certificates was reduced to 398 days. Certificates with durations greater than this are considered invalid by many browsers and will not allow communication with sites that have them. Furthermore, shorter renewal periods offer the best chance to continuously use the latest and most secure encryption. Certificates with very long validity durations may become suspect to attack if vulnerabilities are eventually found in the algorithm.","recommendedRemediation":"Certificates with validity durations longer than 398 days should be replaced with valid certificates within the 398 day limit. All new and renewed certificates should follow this limit as well, with a process expectation of roughly a yearly cycle for all certificates.","knownExploitedVulnCount":0,"checkID":"ssl_expiry_long","category":"ssl","controlCheckID":"IM.EN.DT.AA","passTitle":"SSL expiration period shorter than 398 days","passDescription":"The SSL certificate presented by the server has an expiration period shorter than 398 days.","passGroupDescription":"All SSL certificates expiration periods are shorter than 398 days.","failTitle":"SSL expiration period longer than 398 days","failDescription":"Certificates issued on or after September 1, 2020 must not have a validity period greater than 398 days. The certificate will need to be reissued with a maximum validity of 397 days.","remediation":"Re-issue SSL certificates.","issue":"Impacted domains have SSL certificates which have expiration periods longer than 398 days. Browsers enforce a maximum certificate expiration of 398 days.","recommendation":"We recommend that you re-issue impacted SSL certificates.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","RiskDetails":"As of September 1 2020, the maximum supported validity duration for SSL/TLS certificates was reduced to 398 days. Certificates with durations greater than this are considered invalid by many browsers and will not allow communication with sites that have them. Furthermore, shorter renewal periods offer the best chance to continuously use the latest and most secure encryption. Certificates with very long validity durations may become suspect to attack if vulnerabilities are eventually found in the algorithm.","RecommendedRemediation":"Certificates with validity durations longer than 398 days should be replaced with valid certificates within the 398 day limit. All new and renewed certificates should follow this limit as well, with a process expectation of roughly a yearly cycle for all certificates."},{"id":"ssl_expires_soon","pass":true,"meta":"2027-01-08 23:59:59 UTC, 2027-03-18 23:59:59 UTC","vendorOnly":false,"expected":[{"property":"SSL > Expires","value":"[has more than 20% of its valid period remaining]"}],"actual":[{"property":"SSL > Expires","value":"2027-01-08 23:59:59 UTC, 2027-03-18 23:59:59 UTC"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"SSL has more than 20% of its valid period remaining","description":"SSL certificate does not expire in less than 20% of its total valid period.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","riskDetails":"Allowing certificates to expire can affect both security and functionality. An invalid certificate cannot provide proper protection against man-in-the-middle (MITM) attacks, undermining the point of SSL/TLS entirely. Furthermore, most browsers will not allow users to go to sites with expired certificates. If a certificate expires on an important service or system it may render it virtually unreachable until the certificate is renewed.","recommendedRemediation":"A process should be in place to track certificate expiry across all systems and renew them before they expire. Renewed certificates should have a strong encryption algorithm and specify the name of the system they are for. Certificates should be valid for no longer than 398 days, as many browsers will no longer accept validity durations beyond this limit.","knownExploitedVulnCount":0,"checkID":"ssl_expires_soon","category":"ssl","controlCheckID":"IM.EN.DT.XH","passTitle":"SSL has more than 20% of its valid period remaining","passDescription":"SSL certificate does not expire in less than 20% of its total valid period.","passGroupDescription":"No SSL certificates expire in less than 20% of their total valid period.","failTitle":"SSL expires in less than 20% of its total valid period","failDescription":"SSL certificate has less than 20% of its total valid period remaining. The certificate will need to be renewed to avoid expiry.","remediation":"Renew SSL certificates.","issue":"Impacted domains have SSL certificates which have less than 20% of their total valid period remaining. When certificates expire they become invalid, and will no longer be able to run secure transactions.","recommendation":"We recommend that you renew impacted SSL certificates prior to their expiry to avoid unencrypted communications. This helps keep your customers shape by ensuring adequate encryption.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. Certificates expire after a set period of time and must be renewed to keep SSL/TLS active.","RiskDetails":"Allowing certificates to expire can affect both security and functionality. An invalid certificate cannot provide proper protection against man-in-the-middle (MITM) attacks, undermining the point of SSL/TLS entirely. Furthermore, most browsers will not allow users to go to sites with expired certificates. If a certificate expires on an important service or system it may render it virtually unreachable until the certificate is renewed.","RecommendedRemediation":"A process should be in place to track certificate expiry across all systems and renew them before they expire. Renewed certificates should have a strong encryption algorithm and specify the name of the system they are for. Certificates should be valid for no longer than 398 days, as many browsers will no longer accept validity durations beyond this limit."},{"id":"ssl_strength","pass":true,"meta":"ECDSA-SHA384, SHA256-RSA","vendorOnly":false,"expected":[{"property":"SSL > Algorithm","value":"[at least 'sha256']"}],"actual":[{"property":"SSL > Algorithm","value":"ECDSA-SHA384, SHA256-RSA"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Strong SSL algorithm","description":"Industry standard SHA-256 encryption in use.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Every certificate utilizes an encryption algorithm to scramble the encrypted data and make it unreadable. These algorithms are designed to be extremely difficult to reverse engineer, giving the best protection. Better algorithms are incorporated as they come about and certificates are constantly adapting to more secure standards.","riskDetails":"Although encryption algorithms are designed to be difficult to break, they are occasionally broken. When an algorithm has been successfully reverse engineered, it is no longer considered secure, as third parties may be able to access the encrypted data with an imposter key. Even when an algorithm hasn’t been breached, new algorithms may provide increased protection and are thus preferable over maintaining older algorithms. Most browsers have a changing list of approved encryption algorithms. If an algorithm is not approved, the browser will not be able to access that site.","recommendedRemediation":"Certificates with weak SSL algorithms should be replaced with new valid certificates from a trusted authority. When requesting the certificate, you will be able to specify stronger encryption algorithms from the issuer. Because algorithms are always changing, it is important to consistently renew certificates about every year and always use the most secure algorithm available at the time of renewal.","knownExploitedVulnCount":0,"checkID":"ssl_strength","category":"ssl","controlCheckID":"IM.EN.SE.PA","passTitle":"Strong SSL algorithm","passDescription":"Industry standard SHA-256 encryption in use.","passGroupDescription":"Industry standard encryption in use.","failTitle":"Weak SSL algorithm","failDescription":"Industry standard SHA-256 encryption is not in use. The SSL certificate should be migrated to a SHA-256 certificate.","remediation":"Upgrade to at least SHA-256 encryption for SSL certificates.","issue":"The impacted domains are using a weak SSL-cipher. It’s important to only use strong ciphers on websites to ensure secure communications with visitors. Otherwise, attackers may be able to decrypt SSL traffic between the server and visitors.","recommendation":"Migrate to an SSL certificate that uses the industry standard, SHA-256 encryption. SHA-256 provides stronger encryption and has replaced SHA-1 as the defacto standard for encryption on the web.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. These certificates provide a keypair, private and public, that is used to guarantee the encryption. Every certificate utilizes an encryption algorithm to scramble the encrypted data and make it unreadable. These algorithms are designed to be extremely difficult to reverse engineer, giving the best protection. Better algorithms are incorporated as they come about and certificates are constantly adapting to more secure standards.","RiskDetails":"Although encryption algorithms are designed to be difficult to break, they are occasionally broken. When an algorithm has been successfully reverse engineered, it is no longer considered secure, as third parties may be able to access the encrypted data with an imposter key. Even when an algorithm hasn’t been breached, new algorithms may provide increased protection and are thus preferable over maintaining older algorithms. Most browsers have a changing list of approved encryption algorithms. If an algorithm is not approved, the browser will not be able to access that site.","RecommendedRemediation":"Certificates with weak SSL algorithms should be replaced with new valid certificates from a trusted authority. When requesting the certificate, you will be able to specify stronger encryption algorithms from the issuer. Because algorithms are always changing, it is important to consistently renew certificates about every year and always use the most secure algorithm available at the time of renewal."},{"id":"http_strict_transport_security_preload_list","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"HSTS Preload List","value":"[entry found]"}],"actual":[{"property":"HSTS Preload List","value":"[entry found]"}],"severity":2,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Domain is included on the HSTS preload list","description":"Being included on the preload list gives the highest level of protection against MITM attacks for users of all major browsers.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. HTTP Strict Transport Security (HSTS) ensures that no HTTP connections will be allowed from the server. This forces the use of HTTPS, which maintains encryption at all times. Google hosts an HSTS preload list that is used in most browsers. Domains on this list will automatically establish encrypted connections from the browser, giving them the best protection.","riskDetails":"If a domain is not on the preload list, browsers may still attempt to make unencrypted HTTP connections to systems in that domain. This can create a situation where credentials or other sensitive information is passed in plain text before being sent to HTTPS, for example if it is part of the initial connection URL. Because the HSTS preload list is already incorporated into most browsers, it provides a seamless way to ensure only HTTPS connections are used.","recommendedRemediation":"Add the domain to the preload list by following the steps at https://hstspreload.org. There are several prerequisites to approval, including the need for a valid certificate, an HTTP to HTTPS redirect and that all subdomains are served over HTTPS as well. Your HSTS header must also be properly configured, containing both the IncludeSubDomains and Preload directives.","knownExploitedVulnCount":0,"checkID":"http_strict_transport_security_preload_list","category":"ssl","controlCheckID":"IM.EN.ET.ZW","passTitle":"Domain is included on the HSTS preload list","passDescription":"Being included on the preload list gives the highest level of protection against MITM attacks for users of all major browsers.","passGroupDescription":"All domains are included on the HSTS preload list.","failTitle":"Domain was not found on the HSTS preload list","failDescription":"The domain was not found on the HSTS preload list. Users who visit the website for the first time will be vulnerable to MITM attacks. The requirements for inclusion on the preload list are specified by hstspreload.org.","remediation":"Follow the instructions given by hstspreload.org.","issue":"Impacted domains are not included on the HSTS preload list. New visitors are vulnerable to man-in-the-middle attacks as they will try to connect to the website through HTTP.","recommendation":"Follow the instructions set out on https://hstspreload.org. This ensures major browsers like Chrome, Firefox, Opera, Safari, IE11, and Edge always connect over HTTPS, mitigating man-in-the-middle risk.","defaultSeverity":2,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. SSL/TLS uses the HTTPS protocol, so all client connections must be rerouted from HTTP to HTTPS when necessary. HTTP Strict Transport Security (HSTS) ensures that no HTTP connections will be allowed from the server. This forces the use of HTTPS, which maintains encryption at all times. Google hosts an HSTS preload list that is used in most browsers. Domains on this list will automatically establish encrypted connections from the browser, giving them the best protection.","RiskDetails":"If a domain is not on the preload list, browsers may still attempt to make unencrypted HTTP connections to systems in that domain. This can create a situation where credentials or other sensitive information is passed in plain text before being sent to HTTPS, for example if it is part of the initial connection URL. Because the HSTS preload list is already incorporated into most browsers, it provides a seamless way to ensure only HTTPS connections are used.","RecommendedRemediation":"Add the domain to the preload list by following the steps at https://hstspreload.org. There are several prerequisites to approval, including the need for a valid certificate, an HTTP to HTTPS redirect and that all subdomains are served over HTTPS as well. Your HSTS header must also be properly configured, containing both the IncludeSubDomains and Preload directives."},{"id":"ssl_certificate_length","pass":true,"meta":"256-bit ECDSA, 2048-bit RSA","vendorOnly":false,"expected":[{"property":"SSL > Public Certificate Key Length","value":"[RSA >= 2048 or ECDSA >= 224]"}],"actual":[{"property":"SSL > Public Certificate Key Length","value":"256-bit ECDSA, 2048-bit RSA"}],"severity":2,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Strong public certificate key length","description":"The site's public certificate provides at least 112 bits of security strength.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":"ssl_certificate_length_provisional","summary":"The key length in an SSL certificate is a critical factor in determining the strength of the encryption used to secure communications between a user's browser and a website. Keys that are too short are not long enough to provide adequate security.","riskDetails":"A weak key length, such as 1024 bits or shorter, is vulnerable to brute-force attacks, where attackers use computational power to try every possible key until they find the correct one. Advances in computing power have made it possible to break shorter keys within a feasible amount of time.","recommendedRemediation":"If a certificate is found to have a weak public key length, it should be reissued with a stronger key. This involves generating a new key pair with a recommended key length (2048 bits or higher for RSA) and obtaining a new certificate from a trusted Certificate Authority.","knownExploitedVulnCount":0,"checkID":"ssl_certificate_length","category":"ssl","controlCheckID":"IM.EN.SE.ZW","passTitle":"Strong public certificate key length","passDescription":"The site's public certificate provides at least 112 bits of security strength.","passGroupDescription":"All public certificates provide at least 112 bits of security strength.","failTitle":"Weak public certificate key length","failDescription":"Public key algorithms and key sizes offering less than 112 bits of security strength are no longer considered secure. Public RSA keys should be at least 2048-bit and ECDSA keys should be at least 224-bit.","remediation":"Ensure public RSA keys are at least 2048-bit, and ECDSA keys are at least 224-bit.","issue":"The impacted domains are using weak public certificates, making them more vulnerable to man-in-the-middle attacks.","recommendation":"Migrate to an RSA certificate of at least 2048-bits or an ECDSA certificate  of at least 224-bits.","defaultSeverity":2,"categoryTotalCost":2,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"The key length in an SSL certificate is a critical factor in determining the strength of the encryption used to secure communications between a user's browser and a website. Keys that are too short are not long enough to provide adequate security.","RiskDetails":"A weak key length, such as 1024 bits or shorter, is vulnerable to brute-force attacks, where attackers use computational power to try every possible key until they find the correct one. Advances in computing power have made it possible to break shorter keys within a feasible amount of time.","RecommendedRemediation":"If a certificate is found to have a weak public key length, it should be reissued with a stronger key. This involves generating a new key pair with a recommended key length (2048 bits or higher for RSA) and obtaining a new certificate from a trusted Certificate Authority."}],"ip_domain_reputation":[{"id":"botnet_active","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Botnet Activity","value":"false"}],"actual":[{"property":"Botnet Activity","value":""}],"severity":4,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of botnet activity in the last 30 days","description":"This IP/domain has not been reported as a source of botnet activity in the last 30 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts observed communicating with botnet infrastructure may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that are infected with botnet malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation.","recommendedRemediation":"If a host is suspected of botnet activity, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"botnet_active","category":"malware","controlCheckID":"IM.IP.MA.KA","passTitle":"No reports of botnet activity in the last 30 days","passDescription":"This IP/domain has not been reported as a source of botnet activity in the last 30 days.","passGroupDescription":"No IPs/domains have been reported as a source of botnet activity in the last 30 days.","failTitle":"Suspected of botnet activity","failDescription":"This IP/domain has been reported as a source of botnet activity in the last 30 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for botnet activity in the last 30 days. These reports may affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":4,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts observed communicating with botnet infrastructure may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that are infected with botnet malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation.","RecommendedRemediation":"If a host is suspected of botnet activity, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"brute_force_login_active","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Unsolicited Communication > Brute Force Login Attempt","value":"false"}],"actual":[{"property":"Unsolicited Communication > Brute Force Login Attempt","value":""}],"severity":4,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of brute force login attempts in the last 30 days","description":"This IP/domain did not appear on any list of IPs and domains known to perform brute force login attempts in the last 30 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"As part of gaininig initial access, attackers use compromised hosts to attempt brute force logins to other hosts. Using compromised hosts for this activity allows the attacker to disguise their presence.","riskDetails":"A host that has been observed attempting brute force logins may be compromised by an attacker. Even if that is not the case, this behavior may cause the domain or IP to be added to a blocklist to prevent future login attempts.","recommendedRemediation":"If a host has been reported for attempted brute force logins, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"brute_force_login_active","category":"malware","controlCheckID":"IM.IP.MA.VG","passTitle":"No reports of brute force login attempts in the last 30 days","passDescription":"This IP/domain did not appear on any list of IPs and domains known to perform brute force login attempts in the last 30 days.","passGroupDescription":"No IPs/domains appeared on any list of IPs and domains known to perform brute force login attempts in the last 30 days.","failTitle":"Suspected of brute force login attempt","failDescription":"This IP/domain has appeared on a list of IPs and domains reported for performing brute force login attempts in the last 30 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for brute force login attempts in the last 30 days. These reports can affect the reputation of the IP/domain and may be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":4,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"As part of gaininig initial access, attackers use compromised hosts to attempt brute force logins to other hosts. Using compromised hosts for this activity allows the attacker to disguise their presence.","RiskDetails":"A host that has been observed attempting brute force logins may be compromised by an attacker. Even if that is not the case, this behavior may cause the domain or IP to be added to a blocklist to prevent future login attempts.","RecommendedRemediation":"If a host has been reported for attempted brute force logins, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"malware_server_active","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Malware Server","value":"false"}],"actual":[{"property":"Malware Server","value":""}],"severity":4,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of malware distribution in the last 30 days","description":"This IP/domain has been reported for distributing malware in the last 30 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts observed distributing malware may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that are used for distributing malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","recommendedRemediation":"If a host is suspected of distributing malware, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"malware_server_active","category":"malware","controlCheckID":"IM.IP.MA.KW","passTitle":"No reports of malware distribution in the last 30 days","passDescription":"This IP/domain has been reported for distributing malware in the last 30 days.","passGroupDescription":"No IPs/domains have been reported for distributing malware in the last 30 days.","failTitle":"Suspected of distributing malware","failDescription":"This IP/domain has been reported for distributing malware in the last 30 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for distributing malware in the last 30 days. These reports may affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":4,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts observed distributing malware may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that are used for distributing malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","RecommendedRemediation":"If a host is suspected of distributing malware, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"unsolicited_scanning_active","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Unsolicited Communication > Scanning","value":"false"}],"actual":[{"property":"Unsolicited Communication > Scanning","value":""}],"severity":4,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of unsolicited scanning in the last 30 days","description":"This IP/domain has not been reported for performing unsolicited scanning in the last 30 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"As part of reconnaissance activity, attackers will use compromised hosts to scan other hosts with the aim of discovering possible attack methods. This scanning activity can be detected by patterns in the requests sent, and the host performing the unwanted scanning is then reported to shared blocklists.","riskDetails":"There may be other reasons for a host to perform unsolicited scanning, but this behavior can indicate that the host is compromised and running malware responsible for the scanning. The presence of the host on blocklists for scanning may result in it being blocked by other users even if the activity is not the result of malware.","recommendedRemediation":"If a host has been reported for unsolicited scanning, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"unsolicited_scanning_active","category":"malware","controlCheckID":"IM.IP.MA.XG","passTitle":"No reports of unsolicited scanning in the last 30 days","passDescription":"This IP/domain has not been reported for performing unsolicited scanning in the last 30 days.","passGroupDescription":"No IPs/domains have been reported for performing unsolicited scanning in the last 30 days.","failTitle":"Suspected of unsolicited scanning","failDescription":"This IP/domain has been reported for performing unsolicited scanning in the last 30 days. The server should be checked to ensure this behavior is intentional and not the result of malware.","remediation":"Check IP/domain for offending software.","issue":"IPs/domains have have been reported for performing unsolicited scanning in the last 30 days. This behavior could affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":4,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"As part of reconnaissance activity, attackers will use compromised hosts to scan other hosts with the aim of discovering possible attack methods. This scanning activity can be detected by patterns in the requests sent, and the host performing the unwanted scanning is then reported to shared blocklists.","RiskDetails":"There may be other reasons for a host to perform unsolicited scanning, but this behavior can indicate that the host is compromised and running malware responsible for the scanning. The presence of the host on blocklists for scanning may result in it being blocked by other users even if the activity is not the result of malware.","RecommendedRemediation":"If a host has been reported for unsolicited scanning, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"phishing_site_active","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Phishing Site","value":"false"}],"actual":[{"property":"Phishing Site","value":""}],"severity":4,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of phishing activity in the last 30 days","description":"This IP/domain has not been reported as a phishing site in the last 30 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts suspected of phishing may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that are reported as phishing sites may be compromised in whole or part. Ownership of the domain may have lapsed, allowing attackers to take it over. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","recommendedRemediation":"If a host is suspected of being a phishing site, investigate the host to determine whether it has been compromised. Reviewing the current and historical site content should help show whether it has been modified to operate as a phishing site. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"phishing_site_active","category":"malware","controlCheckID":"IM.IP.MA.EA","passTitle":"No reports of phishing activity in the last 30 days","passDescription":"This IP/domain has not been reported as a phishing site in the last 30 days.","passGroupDescription":"No IPs/domains have been reported as a phishing site in the last 30 days.","failTitle":"Suspected phishing site","failDescription":"This IP/domain has been reported as a phishing site in the last 30 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove phishing code.","issue":"IPs/domains have been reported for phishing sites in the last 30 days. These sites may be compromised and under the control of threat actors.","recommendation":"The owner of the identified IP/domains needs to check for any unwanted software and remove any phishing code.","defaultSeverity":4,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.2.3"],"ISO2022Controls":["5.14"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts suspected of phishing may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that are reported as phishing sites may be compromised in whole or part. Ownership of the domain may have lapsed, allowing attackers to take it over. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","RecommendedRemediation":"If a host is suspected of being a phishing site, investigate the host to determine whether it has been compromised. Reviewing the current and historical site content should help show whether it has been modified to operate as a phishing site. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"botnet_inactive","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Botnet Activity","value":"false"}],"actual":[{"property":"Botnet Activity","value":""}],"severity":1,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of botnet activity in the last 90 days","description":"This IP/domain has not been reported as a source of botnet activity in the last 90 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts observed communicating with botnet infrastructure may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that are infected with botnet malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation.","recommendedRemediation":"If a host is suspected of botnet activity, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"botnet_inactive","category":"malware","controlCheckID":"IM.IP.MA.TG","passTitle":"No reports of botnet activity in the last 90 days","passDescription":"This IP/domain has not been reported as a source of botnet activity in the last 90 days.","passGroupDescription":"No IPs/domains have been reported as a source of botnet activity in the last 90 days.","failTitle":"Suspected of botnet activity in last 90 days","failDescription":"This IP/domain appeared on a list of IPs and domains known as source botnet activity in the last 90 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for botnet activity in the last 90 days. These reports may affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts observed communicating with botnet infrastructure may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that are infected with botnet malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation.","RecommendedRemediation":"If a host is suspected of botnet activity, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"brute_force_login_inactive","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Unsolicited Communication > Brute Force Login Attempt","value":"false"}],"actual":[{"property":"Unsolicited Communication > Brute Force Login Attempt","value":""}],"severity":1,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of brute force login attempts in the last 90 days","description":"This IP/domain did not appear on any list of IPs and domains known to perform brute force login attempts in the last 90 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"As part of gaininig initial access, attackers use compromised hosts to attempt brute force logins to other hosts. Using compromised hosts for this activity allows the attacker to disguise their presence. Hosts observed attempting logins in the last 90 days may be compromised or on blocklists.","riskDetails":"A host that has been observed attempting brute force logins may be compromised by an attacker. Even if that is not the case, this behavior may cause the domain or IP to be added to a blocklist to prevent future login attempts.","recommendedRemediation":"If a host has been reported for attempted brute force logins, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"brute_force_login_inactive","category":"malware","controlCheckID":"IM.IP.MA.DQ","passTitle":"No reports of brute force login attempts in the last 90 days","passDescription":"This IP/domain did not appear on any list of IPs and domains known to perform brute force login attempts in the last 90 days.","passGroupDescription":"No IPs/domains appeared on any list of IPs and domains known to perform brute force login attempts in the last 90 days.","failTitle":"Suspected of brute force login attempt in the last 90 days","failDescription":"This IP/domain has appeared on a list of IPs and domains reported for performing brute force login attempts in the last 90 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for brute force login attempts in the last 90 days. These reports can affect the reputation of the IP/domain and may be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"As part of gaininig initial access, attackers use compromised hosts to attempt brute force logins to other hosts. Using compromised hosts for this activity allows the attacker to disguise their presence. Hosts observed attempting logins in the last 90 days may be compromised or on blocklists.","RiskDetails":"A host that has been observed attempting brute force logins may be compromised by an attacker. Even if that is not the case, this behavior may cause the domain or IP to be added to a blocklist to prevent future login attempts.","RecommendedRemediation":"If a host has been reported for attempted brute force logins, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"malware_server_inactive","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Malware Server","value":"false"}],"actual":[{"property":"Malware Server","value":""}],"severity":1,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of malware distribution in the last 90 days","description":"This IP/domain has been reported for distributing malware in the last 90 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts observed distributing malware may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that have recently been used for distributing malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","recommendedRemediation":"If a host is suspected of distributing malware, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"malware_server_inactive","category":"malware","controlCheckID":"IM.IP.MA.QG","passTitle":"No reports of malware distribution in the last 90 days","passDescription":"This IP/domain has been reported for distributing malware in the last 90 days.","passGroupDescription":"No IPs/domains have been reported for distributing malware in the last 90 days.","failTitle":"Suspected of distributing malware in last 90 days","failDescription":"This IP/domain has been reported for distributing malware in the last 90 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove offending software.","issue":"IPs/domains have been reported for distributing malware in the last 90 days. These reports may affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts observed distributing malware may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that have recently been used for distributing malware may be used to further attack other infrastructure and/or collect sensitive information from an organization's systems. That information can in turn lead to further exploitation. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","RecommendedRemediation":"If a host is suspected of distributing malware, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and its cause. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"unsolicited_scanning_inactive","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Unsolicited Communication > Scanning","value":"false"}],"actual":[{"property":"Unsolicited Communication > Scanning","value":""}],"severity":1,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of unsolicited scanning in the last 90 days","description":"This IP/domain has not been reported for performing unsolicited scanning in the last 90 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"As part of reconnaissance activity, attackers will use compromised hosts to scan other hosts with the aim of discovering possible attack methods. Reports of unsolicited scanning in the last 90 days may indicate the host is infected or has been placed on blocklists that will affect availability.","riskDetails":"There may be other reasons for a host to perform unsolicited scanning, but this behavior can indicate that the host is compromised and running malware responsible for the scanning. The presence of the host on blocklists for scanning may result in it being blocked by other users even if the activity is not the result of malware.","recommendedRemediation":"If a host has been reported for unsolicited scanning, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"unsolicited_scanning_inactive","category":"malware","controlCheckID":"IM.IP.MA.AA","passTitle":"No reports of unsolicited scanning in the last 90 days","passDescription":"This IP/domain has not been reported for performing unsolicited scanning in the last 90 days.","passGroupDescription":"No IPs/domains have been reported for performing unsolicited scanning in the last 90 days.","failTitle":"Suspected of unsolicited scanning in last 90 days","failDescription":"This IP/domain has been reported for performing unsolicited scanning in the last 90 days. The server should be checked to ensure this behavior is intentional and not the result of malware.","remediation":"Check IP/domain for offending software.","issue":"IPs/domains have have been reported for performing unsolicited scanning in the last 90 days. This behavior could affect the reputation of the IP/domain and be a symptom of unwanted software installed in the server.","recommendation":"The owner of the identified IPs/domains should check for and remove any offending software.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.12.2.1"],"ISO2022Controls":["8.7"],"NISTControls":["PR.DS-6","DE.CM-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"As part of reconnaissance activity, attackers will use compromised hosts to scan other hosts with the aim of discovering possible attack methods. Reports of unsolicited scanning in the last 90 days may indicate the host is infected or has been placed on blocklists that will affect availability.","RiskDetails":"There may be other reasons for a host to perform unsolicited scanning, but this behavior can indicate that the host is compromised and running malware responsible for the scanning. The presence of the host on blocklists for scanning may result in it being blocked by other users even if the activity is not the result of malware.","RecommendedRemediation":"If a host has been reported for unsolicited scanning, investigate the host to determine whether it has been compromised. That should include reviewing logs to identify the reported activity and the cause of it. If the host is behaving as expected, contact the blocklist owner to have the host removed."},{"id":"phishing_site_inactive","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Phishing Site","value":"false"}],"actual":[{"property":"Phishing Site","value":""}],"severity":1,"cloudscanCategory":"ip_domain_reputation","prevCloudscanCategory":"phishing","title":"No reports of phishing activity in the last 90 days","description":"This IP/domain has not been reported as a phishing site in the last 90 days.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Hosts suspected of phishing may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","riskDetails":"Hosts that have been reported as phishing sites may be compromised in whole or part. Ownership of the domain may have lapsed, allowing attackers to take it over. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","recommendedRemediation":"If a host is suspected of being a phishing site, investigate the host to determine whether it has been compromised. Reviewing the current and historical site content should help show whether it has been modified to operate as a phishing site. If the host is behaving as expected, contact the blocklist owner to have the host removed.","knownExploitedVulnCount":0,"checkID":"phishing_site_inactive","category":"malware","controlCheckID":"IM.IP.MA.LG","passTitle":"No reports of phishing activity in the last 90 days","passDescription":"This IP/domain has not been reported as a phishing site in the last 90 days.","passGroupDescription":"No IPs/domains have been reported as a phishing site in the last 90 days.","failTitle":"Suspected phishing site in last 90 days","failDescription":"This IP/domain has been reported as a phishing site in the last 90 days. The server should be checked and any offending software removed.","remediation":"Check IP/domain and remove phishing code.","issue":"IPs/domains have been reported for phishing sites in the last 90 days. These sites may be compromised and under the control of threat actors.","recommendation":"The owner of the identified IP/domains needs to check for any unwanted software and remove any phishing code.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.2.3"],"ISO2022Controls":["5.14"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Hosts suspected of phishing may be compromised by attackers. Those hosts are reported on shared blocklists that can affect the reputaton of the domain or IP, and interrupt availability when the hosts are blocked.","RiskDetails":"Hosts that have been reported as phishing sites may be compromised in whole or part. Ownership of the domain may have lapsed, allowing attackers to take it over. Hosts that have recently been on blocklists may also have availability issues even if the IP has changed owners.","RecommendedRemediation":"If a host is suspected of being a phishing site, investigate the host to determine whether it has been compromised. Reviewing the current and historical site content should help show whether it has been modified to operate as a phishing site. If the host is behaving as expected, contact the blocklist owner to have the host removed."}],"network_sec_v2":[{"id":"open_port","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Ports > Ports Open","value":"[all ports closed]"}],"actual":[{"property":"Ports > Ports Open","value":"[all ports closed]"}],"severity":3,"cloudscanCategory":"network_sec_v2","prevCloudscanCategory":"network_sec","title":"No ports are open","description":"No open ports were detected.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"","riskDetails":"","recommendedRemediation":"","knownExploitedVulnCount":0}],"patch_management":[{"id":"verified_vuln:CVE-2014-0160","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Vulnerabilities > CVE-2014-0160","value":"[not vulnerable]"}],"actual":[{"property":"Vulnerabilities > CVE-2014-0160","value":"[not vulnerable]"}],"severity":3,"cloudscanCategory":"patch_management","prevCloudscanCategory":"website_sec","title":"Not vulnerable to CVE-2014-0160 (Heartbleed)","description":"A bug in OpenSSL's implementation of the TLS heartbeat extension allows access to portions of memory on the targeted host e.g. cryptographic keys and passwords.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"","riskDetails":"","recommendedRemediation":"","knownExploitedVulnCount":1,"isVerifiedVuln":true},{"id":"verified_vuln:CVE-2014-3566","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Vulnerabilities > CVE-2014-3566","value":"[not vulnerable]"}],"actual":[{"property":"Vulnerabilities > CVE-2014-3566","value":"[not vulnerable]"}],"severity":3,"cloudscanCategory":"patch_management","prevCloudscanCategory":"website_sec","title":"Not vulnerable to CVE-2014-3566 (POODLE)","description":"The server does not support SSLv3, and is not vulnerable to the POODLE attack.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"","riskDetails":"","recommendedRemediation":"","knownExploitedVulnCount":0,"isVerifiedVuln":true},{"id":"verified_vuln:CVE-2015-0204","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Vulnerabilities > CVE-2015-0204","value":"[not vulnerable]"}],"actual":[{"property":"Vulnerabilities > CVE-2015-0204","value":"[not vulnerable]"}],"severity":3,"cloudscanCategory":"patch_management","prevCloudscanCategory":"website_sec","title":"Not vulnerable to CVE-2015-0204 (FREAK)","description":"The server does not offer RSA_EXPORT cipher suites, so clients are not vulnerable to the FREAK attack.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"","riskDetails":"","recommendedRemediation":"","knownExploitedVulnCount":0,"isVerifiedVuln":true},{"id":"verified_vuln:CVE-2015-4000","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Vulnerabilities > CVE-2015-4000","value":"[not vulnerable]"}],"actual":[{"property":"Vulnerabilities > CVE-2015-4000","value":"[not vulnerable]"}],"severity":3,"cloudscanCategory":"patch_management","prevCloudscanCategory":"website_sec","title":"Not vulnerable to CVE-2015-4000 (Logjam)","description":"The server is using strong Diffie-Hellman parameters and is not vulnerable to the Logjam attack.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":null,"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"","riskDetails":"","recommendedRemediation":"","knownExploitedVulnCount":0,"isVerifiedVuln":true}],"website_sec_v2":[{"id":"server_information_header","pass":true,"meta":"awselb/2.0","vendorOnly":false,"expected":[{"property":"Headers > server","value":"[does not contain version number]"}],"actual":[{"property":"Headers > server","value":"awselb/2.0"}],"severity":3,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"Server information header not exposed","description":"Ensuring the server information header is not exposed reduces the ability of attackers to exploit certain vulnerabilities.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. These headers are configured on the server, and depending on the platform, may contain default values for these fields. The Server header is specifically used to describe the type and version of web server software, e.g. Server: Apache/2.4.1 (Unix).","riskDetails":"Some technologies populate the Server header by default. If the Server header is exposed, the risk of an attack on the system is increased. The exposed information specifies the type and version of software currently running. This can be used by malicious actors to pinpoint vulnerabilities in the server, especially on systems running older versions of software. These headers can be harvested programmatically since they are offered publicly, making it easy to discover systems with populated headers across the internet.","recommendedRemediation":"The Server header should be removed, blanked out or minimized. The method for doing so differs based on technology. In IIS, a URL rewrite rule can be used to replace the server header with a blank string. In Apache, however, the Server header cannot be blanked out, but can be configured to display only “Apache” by setting “ServerTokens Prod” in the Apache config file. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared.","knownExploitedVulnCount":0,"checkID":"server_information_header","category":"discovery","controlCheckID":"IM.WS.MI.VG","passTitle":"Server information header not exposed","passDescription":"Ensuring the server information header is not exposed reduces the ability of attackers to exploit certain vulnerabilities.","passGroupDescription":"No sites are exposing unnecessary server header information.","failTitle":"Server information header exposed","failDescription":"Exposing information about the server version increases the ability of attackers to exploit certain vulnerabilities. The website configuration should be changed to prevent version information being revealed in the 'server' header.","remediation":"Remove 'server' header.","issue":"The web server information of the impacted websites is exposed. Exposing information about the server version increases the ability of attackers to exploit known vulnerabilities.","recommendation":"Configure these websites to prevent version information from being revealed by removing the 'Server' header. This reduces the chance of attackers successfully exploiting known vulnerabilities.","defaultSeverity":3,"categoryTotalCost":5,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. These headers are configured on the server, and depending on the platform, may contain default values for these fields. The Server header is specifically used to describe the type and version of web server software, e.g. Server: Apache/2.4.1 (Unix).","RiskDetails":"Some technologies populate the Server header by default. If the Server header is exposed, the risk of an attack on the system is increased. The exposed information specifies the type and version of software currently running. This can be used by malicious actors to pinpoint vulnerabilities in the server, especially on systems running older versions of software. These headers can be harvested programmatically since they are offered publicly, making it easy to discover systems with populated headers across the internet.","RecommendedRemediation":"The Server header should be removed, blanked out or minimized. The method for doing so differs based on technology. In IIS, a URL rewrite rule can be used to replace the server header with a blank string. In Apache, however, the Server header cannot be blanked out, but can be configured to display only “Apache” by setting “ServerTokens Prod” in the Apache config file. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared."},{"id":"x_powered_by_header","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Headers > x-powered-by","value":"[not set]"}],"actual":[{"property":"Headers > x-powered-by","value":"[not set]"}],"severity":3,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"X-Powered-By header not exposed","description":"Information about specific technology used on the server is obscured.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. These headers are configured on the server, and depending on the platform, may contain default values for these fields. The X-Powered-By header is specifically used to describe technologies in use on the server, such as the type and version of web server software or PHP.","riskDetails":"Some technologies populate the X-Powered-By header by default. If the X-Powered-By header is exposed, the risk of an attack on the server is increased. The exposed information often specifies the type and version of software currently running. This can be used by malicious actors to pinpoint vulnerabilities in the server, especially on systems running older versions of software. These headers can be harvested programmatically since they are offered publicly, making it easy to discover systems with populated headers across the internet.","recommendedRemediation":"The X-Powered-By header should be removed. The specific process for this varies by technology. PHP versions can often be found in the X-Powered-By field. This can be disabled by switching “expose_php” to OFF in php.ini. In Microsoft IIS, the header can be removed under HTTP Response Headers in the GUI. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared.","knownExploitedVulnCount":0,"checkID":"x_powered_by_header","category":"discovery","controlCheckID":"IM.WS.MI.PA","passTitle":"X-Powered-By header not exposed","passDescription":"Information about specific technology used on the server is obscured.","passGroupDescription":"No sites are exposing the X-Powered-By header.","failTitle":"X-Powered-By header exposed","failDescription":"The X-Powered-By header reveals information about specific technology used on the server. This information can be used to exploit vulnerabilities. The server configuration should be changed to remove this header.","remediation":"Remove X-Powered-By header.","issue":"We've found websites that have their X-Powered-By header exposed. This header reveals information about the specific technology used to run the website which could be used to find known vulnerabilities that can be exploited.","recommendation":"The website needs to stop exposing the X-Powered-By header. This reduces the risk that an attacker will be able to find an exploitable vulnerability in the software running the website.","defaultSeverity":3,"categoryTotalCost":4,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. These headers are configured on the server, and depending on the platform, may contain default values for these fields. The X-Powered-By header is specifically used to describe technologies in use on the server, such as the type and version of web server software or PHP.","RiskDetails":"Some technologies populate the X-Powered-By header by default. If the X-Powered-By header is exposed, the risk of an attack on the server is increased. The exposed information often specifies the type and version of software currently running. This can be used by malicious actors to pinpoint vulnerabilities in the server, especially on systems running older versions of software. These headers can be harvested programmatically since they are offered publicly, making it easy to discover systems with populated headers across the internet.","RecommendedRemediation":"The X-Powered-By header should be removed. The specific process for this varies by technology. PHP versions can often be found in the X-Powered-By field. This can be disabled by switching “expose_php” to OFF in php.ini. In Microsoft IIS, the header can be removed under HTTP Response Headers in the GUI. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared."},{"id":"referrer_policy_header_v2","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Headers > referrer-policy","value":"[not unsafe-url]"}],"actual":[{"property":"Headers > referrer-policy","value":"[not set]"}],"severity":2,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"Referrer policy is not unsafe-url","description":"The website's Referrer Policy is not configured to allow unsafe information to be sent in the referrer header.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":"referrer_policy_header","summary":"The Referrer header controls how much information is sent to another site owner when the website links to that site. Providing sufficiently sanitized information to other websites can be done safely, but the \"unsafe\" referrer policy allows excessive information to be passed that may affect the privacy and security of users of your site.","riskDetails":"W3.org writes: \"The policy’s name doesn’t lie; it is unsafe. This policy will leak origins and paths from TLS-protected resources to insecure origins. Carefully consider the impact of setting such a policy for potentially sensitive documents.\" The risk is that links to http origins will still include the full URL, potentially leaking data included in the URL to an insecure origin.","recommendedRemediation":"Remove the \"unsafe-url\" directive from the Referrer header.","knownExploitedVulnCount":0,"checkID":"referrer_policy_header_v2","category":"discovery","controlCheckID":"IM.WS.MI.ZW","passTitle":"Referrer policy is not unsafe-url","passDescription":"The website's Referrer Policy is not configured to allow unsafe information to be sent in the referrer header.","passGroupDescription":"No websites have an unsafe Referrer Policy.","failTitle":"Referrer Policy is unsafe-url","failDescription":"The full URL (stripped of parameters) is sent in the referrer header when performing same-origin or cross-origin requests. This can expose sensitive information.","remediation":"Set Referrer-Policy to a value other than unsafe-url.","issue":"Impacted domains send the full URL (stripped of parameters) in the referrer header when performing same-origin or cross-origin requests.","recommendation":"The website needs to set the Referrer Policy to a value other than unsafe-url. This will prevent potentially sensitive information from being sent in the referrer header.","defaultSeverity":2,"categoryTotalCost":1,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.20"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"The Referrer header controls how much information is sent to another site owner when the website links to that site. Providing sufficiently sanitized information to other websites can be done safely, but the \"unsafe\" referrer policy allows excessive information to be passed that may affect the privacy and security of users of your site.","RiskDetails":"W3.org writes: \"The policy’s name doesn’t lie; it is unsafe. This policy will leak origins and paths from TLS-protected resources to insecure origins. Carefully consider the impact of setting such a policy for potentially sensitive documents.\" The risk is that links to http origins will still include the full URL, potentially leaking data included in the URL to an insecure origin.","RecommendedRemediation":"Remove the \"unsafe-url\" directive from the Referrer header."},{"id":"asp_net_version_header","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Headers > x-aspnet-version","value":"[not set]"}],"actual":[{"property":"Headers > x-aspnet-version","value":"[not set]"}],"severity":2,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"ASP.NET version header not exposing specific ASP.net version","description":"Ensuring the ASP.NET version header is not exposing a specific version makes it harder for attackers to exploit certain vulnerabilities.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. Default installations of Microsoft IIS web servers often include an HTTP response header called X-AspNet-Version. This can contain the version of ASP.NET that is currently running.","riskDetails":"An exposed ASP.NET version drastically narrows the attack vector for the server and allows malicious actors to immediately begin probing specific ASP.NET and IIS vulnerabilities for that version. Because this header is created by default on most IIS installations, the information is often exposed unbeknownst to the system’s administrators.","recommendedRemediation":"The entire X-AspNet-Version header should be removed. It can be found and removed under HTTP Response Headers in the IIS GUI. Just clearing the value of the header is not enough. Even the presence of the X-AspNet-Version header reveals that some version of ASP.NET and likely IIS is running on the server. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared.","knownExploitedVulnCount":0,"checkID":"asp_net_version_header","category":"discovery","controlCheckID":"IM.WS.MI.AA","passTitle":"ASP.NET version header not exposing specific ASP.net version","passDescription":"Ensuring the ASP.NET version header is not exposing a specific version makes it harder for attackers to exploit certain vulnerabilities.","passGroupDescription":"No sites detected to expose specific ASP.NET versions in headers.","failTitle":"Specific ASP.NET version exposed via header","failDescription":"Exposing a specific ASP.NET version in the ASP.NET version header makes it easier for attackers to exploit certain vulnerabilities. The website configuration should be changed to remove this header completely.","remediation":"Remove x-aspnet-version header.","issue":"The impacted websites are exposing the specific ASP.NET version they use in the ASP.NET version header. This makes it far easier for attackers to exploit certain vulnerabilities.","recommendation":"Configure the identified websites so they don’t expose the X-AspNet-Version header. This minimizes the risk of an attacker finding an exploit in the website.","defaultSeverity":2,"categoryTotalCost":3,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. Default installations of Microsoft IIS web servers often include an HTTP response header called X-AspNet-Version. This can contain the version of ASP.NET that is currently running.","RiskDetails":"An exposed ASP.NET version drastically narrows the attack vector for the server and allows malicious actors to immediately begin probing specific ASP.NET and IIS vulnerabilities for that version. Because this header is created by default on most IIS installations, the information is often exposed unbeknownst to the system’s administrators.","RecommendedRemediation":"The entire X-AspNet-Version header should be removed. It can be found and removed under HTTP Response Headers in the IIS GUI. Just clearing the value of the header is not enough. Even the presence of the X-AspNet-Version header reveals that some version of ASP.NET and likely IIS is running on the server. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared."},{"id":"asp_net_header","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Headers > x-aspnet-version present","value":"[not present]"}],"actual":[{"property":"Headers > x-aspnet-version present","value":"[not present]"}],"severity":2,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"ASP.NET version header not exposed","description":"Ensuring the ASP.NET version header is not exposed makes it harder for attackers to exploit certain vulnerabilities.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. Default installations of Microsoft IIS web servers often include an HTTP response header called X-AspNet-Version. This can contain the version of ASP.NET that is currently running.","riskDetails":"Even if it is not populated, the presence of the X-AspNet-Version header reveals that IIS is running on the system. This drastically narrows the attack vector for the server and allows malicious actors to begin probing known IIS vulnerabilities immediately. Because this header is created by default on most IIS installations, the information is often exposed unbeknownst to the system’s administrators.","recommendedRemediation":"The X-AspNet-Version header should be removed. It can be found and removed under HTTP Response Headers in the IIS GUI. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared.","knownExploitedVulnCount":0,"checkID":"asp_net_header","category":"discovery","controlCheckID":"IM.WS.MI.XG","passTitle":"ASP.NET version header not exposed","passDescription":"Ensuring the ASP.NET version header is not exposed makes it harder for attackers to exploit certain vulnerabilities.","passGroupDescription":"No sites detected to expose ASP.NET headers.","failTitle":"Use of ASP.NET exposed via header","failDescription":"Exposing the ASP.NET version header indicates that the site is built with ASP.NET, which makes it easier for attackers to exploit certain vulnerabilities. The website configuration should be changed to remove this header.","remediation":"Remove x-aspnet-version header.","issue":"We've found websites that expose the ASP.NET version header which indicates that the site is built with ASP.NET. This makes it easier for attackers to exploit certain vulnerabilities.","recommendation":"Configure the identified websites so they don’t expose the X-AspNet-Version header. This minimizes the risk of an attacker finding an exploit in the website.","defaultSeverity":2,"categoryTotalCost":2,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.9"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"HTTP response headers pass additional information about the web server being contacted to the client contacting it. Such information can include the age of cached information, any redirection targets, and descriptions of currently running software. Default installations of Microsoft IIS web servers often include an HTTP response header called X-AspNet-Version. This can contain the version of ASP.NET that is currently running.","RiskDetails":"Even if it is not populated, the presence of the X-AspNet-Version header reveals that IIS is running on the system. This drastically narrows the attack vector for the server and allows malicious actors to begin probing known IIS vulnerabilities immediately. Because this header is created by default on most IIS installations, the information is often exposed unbeknownst to the system’s administrators.","RecommendedRemediation":"The X-AspNet-Version header should be removed. It can be found and removed under HTTP Response Headers in the IIS GUI. Monitoring or auditing of exposed headers on all systems is recommended to ensure information about servers is not being shared."},{"id":"unmaintained_page","pass":true,"meta":"","vendorOnly":false,"expected":[{"property":"Unmaintained Page","value":"[not detected]"}],"actual":[{"property":"Unmaintained Page","value":"[not detected]"}],"severity":1,"cloudscanCategory":"website_sec_v2","prevCloudscanCategory":"website_sec","title":"No unmaintained page detected","description":"The page appears to be maintained.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com:443","corp.roblox.com:80","www.corp.roblox.com:443","www.corp.roblox.com:80"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"The response from the page indicates that it is a default server page or otherwise not configured and maintained for use.","riskDetails":"Unmaintained assets increase the size of the attack surface and are more likely not to be continuously monitored and updated. These additional points on the attack surface give attackers more potential areas to target.","recommendedRemediation":"Sites that are not used should be decommisioned to reduce the attack surface. If the domain is hosting pages that are in use on some other URL and the index of the domain is not intended for the public, access should be removed.","knownExploitedVulnCount":0,"checkID":"unmaintained_page","category":"discovery","controlCheckID":"IM.WS.MI.DQ","passTitle":"No unmaintained page detected","passDescription":"The page appears to be maintained.","passGroupDescription":"All applicable sites appear to be maintained.","failTitle":"Unmaintained page detected","failDescription":"This domain appears to be unmaintained based on indicators like page content or status code. Unmaintained pages expand the attack surface for malicious actors.","remediation":"Review the page and decomission it if it is not active or maintained.","issue":"This domain appears to be unmaintained based on indicators like page content or status code. Unmaintained pages expand the attack surface for malicious actors.","recommendation":"Review the page and decomission it if it is not active or maintained.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.20"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"The response from the page indicates that it is a default server page or otherwise not configured and maintained for use.","RiskDetails":"Unmaintained assets increase the size of the attack surface and are more likely not to be continuously monitored and updated. These additional points on the attack surface give attackers more potential areas to target.","RecommendedRemediation":"Sites that are not used should be decommisioned to reduce the attack surface. If the domain is hosting pages that are in use on some other URL and the index of the domain is not intended for the public, access should be removed."}],"dns":[{"id":"caa_enabled","pass":true,"meta":"iodef mailto:certs@roblox.com, issue amazon.com, issue digicert.com, issue globalsign.com, issue letsencrypt.org, issue pki.goog, issue sectigo.com","vendorOnly":false,"expected":[{"property":"CAA","value":"[set]"}],"actual":[{"property":"CAA","value":"iodef mailto:certs@roblox.com, issue amazon.com, issue digicert.com, issue globalsign.com, issue letsencrypt.org, issue pki.goog, issue sectigo.com"}],"severity":1,"cloudscanCategory":"dns","prevCloudscanCategory":"website_sec","title":"CAA enabled","description":"The domain contains a valid Certification Authority Authorization (CAA) record. A CAA record indicates which Certificate Authorities (CAs) are authorized to issue certificates for a domain.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":null,"sources":["corp.roblox.com","www.corp.roblox.com"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Certificate Authority Authorization (CAA) is a security mechanism that allows domain owners to specify which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for their domain. The CAA policy is enforced through DNS (Domain Name System) records, providing an extra layer of security against unauthorized certificate issuance.","riskDetails":"When a Certificate Authority receives a certificate request for a domain, it is required to check the domain's CAA records before issuing the certificate. Without a CAA, it is possible to have certificates issued for a domain by an unapproved certificate authority.","recommendedRemediation":"CAA is implemented as a DNS resource record (type CAA). Domain owners add CAA records to their DNS zone file, specifying which CAs are allowed to issue certificates for that domain. To allow Let's Encrypt to issue certificates, the record would look like: example.com.  IN  CAA  0 issue \"letsencrypt.org\".","knownExploitedVulnCount":0,"checkID":"caa_enabled","category":"ssl","controlCheckID":"IM.DS.CA.PA","passTitle":"CAA enabled","passDescription":"The domain contains a valid Certification Authority Authorization (CAA) record. A CAA record indicates which Certificate Authorities (CAs) are authorized to issue certificates for a domain.","passGroupDescription":"All applicable sites contain a valid Certification Authority Authorization (CAA) record. A CAA record indicates which Certificate Authorities (CAs) are authorized to issue certificates for a domain.","failTitle":"CAA not enabled","failDescription":"The domain does not contain a valid Certification Authority Authorization (CAA) record. A CAA record indicates which Certificate Authorities (CAs) are authorized to issue certificates for a domain.","remediation":"Where possible, specify the Certificate Authorities that are authorized to issue certificates for this domain in a CAA DNS record.","issue":"The domain does not contain a valid CAA record.","recommendation":"Where possible, specify the Certificate Authorities that are authorized to issue certificates for this domain in a CAA DNS record.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.13.1.1"],"ISO2022Controls":["8.20"],"NISTControls":["PR.AC-5"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Certificate Authority Authorization (CAA) is a security mechanism that allows domain owners to specify which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for their domain. The CAA policy is enforced through DNS (Domain Name System) records, providing an extra layer of security against unauthorized certificate issuance.","RiskDetails":"When a Certificate Authority receives a certificate request for a domain, it is required to check the domain's CAA records before issuing the certificate. Without a CAA, it is possible to have certificates issued for a domain by an unapproved certificate authority.","RecommendedRemediation":"CAA is implemented as a DNS resource record (type CAA). Domain owners add CAA records to their DNS zone file, specifying which CAs are allowed to issue certificates for that domain. To allow Let's Encrypt to issue certificates, the record would look like: example.com.  IN  CAA  0 issue \"letsencrypt.org\"."}]},"failed":{"encryption":[{"id":"ssl_version","pass":false,"meta":"TLSv1, TLSv1.1","vendorOnly":false,"expected":[{"property":"SSL > Insecure Protocol Versions","value":"[none found]"}],"actual":[{"property":"SSL > Insecure Protocol Versions","value":"TLSv1, TLSv1.1"}],"severity":3,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Insecure SSL/TLS versions available","description":"Any version of the SSL protocol, and TLS prior to version 1.2, are now considered insecure. The server should disable support for these old protocols.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":"2018-11-22T00:31:34.66Z","sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. There are multiple versions of SSL and TLS that can be used. Although each version supersedes the last, many times the older protocols remain enabled for legacy support.","riskDetails":"All versions of SSL, and TLS versions below 1.2, are insecure. There are known vulnerabilities for these versions that can allow malicious actors to bypass encryption and access the data. Therefore, these versions of SSL and TLS are susceptible to man-in-the-middle (MITM) attacks, where a third party intercepts data between the client and server.","recommendedRemediation":"Only TLS 1.2 or higher should be allowed. All older versions should be disabled on the server to prevent malicious actors from trying to connect to these vulnerable protocols.","knownExploitedVulnCount":0,"checkID":"ssl_version","category":"ssl","controlCheckID":"IM.EN.SE.UQ","passTitle":"No insecure SSL/TLS versions available","passDescription":"No insecure SSL/TLS versions are available for this site.","passGroupDescription":"No insecure SSL/TLS versions are available for any site.","failTitle":"Insecure SSL/TLS versions available","failDescription":"Any version of the SSL protocol, and TLS prior to version 1.2, are now considered insecure. The server should disable support for these old protocols.","remediation":"Disable support for the SSL protocol and TLS prior to version 1.2.","issue":"Impacted websites are using an insecure SSL/TLS version. Any version of the SSL protocol, and TLS protocol prior to version 1.2 are now insecure. Websites should not use these protocols.","recommendation":"Disable support of the SSL protocol and TLS protocol prior to version 1.2. Doing so will ensure the integrity of communications between the website and its visitors.","defaultSeverity":3,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are mechanisms for securing traffic between two systems. They do this by using an encryption algorithm that makes the data unreadable for everyone except the two systems that possess the necessary certificates. There are multiple versions of SSL and TLS that can be used. Although each version supersedes the last, many times the older protocols remain enabled for legacy support.","RiskDetails":"All versions of SSL, and TLS versions below 1.2, are insecure. There are known vulnerabilities for these versions that can allow malicious actors to bypass encryption and access the data. Therefore, these versions of SSL and TLS are susceptible to man-in-the-middle (MITM) attacks, where a third party intercepts data between the client and server.","RecommendedRemediation":"Only TLS 1.2 or higher should be allowed. All older versions should be disabled on the server to prevent malicious actors from trying to connect to these vulnerable protocols."},{"id":"ssl_weak_cipher","pass":false,"meta":"TLSv1.2: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLSv1.2: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","vendorOnly":false,"expected":[{"property":"SSL > Supported Cipher Suite","value":"[secure ciphers only]"}],"actual":[{"property":"SSL > Supported Cipher Suite","value":"TLSv1.2: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLSv1.2: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}],"severity":1,"cloudscanCategory":"encryption","prevCloudscanCategory":"website_sec","title":"Weak cipher suites supported in TLS 1.2","description":"Weak cipher suites can potentially be broken by a well resourced attacker, and should not be supported by the server unless very old devices or browsers must be supported.","checkedAt":"2026-04-04T05:21:26.786329Z","dateDetected":"2023-05-24T10:24:16.943967Z","sources":["corp.roblox.com:443","www.corp.roblox.com:443"],"none":false,"noneReason":null,"prevProvisionalID":null,"summary":"Transport Layer Security (TLS) 1.2 supports several strong cipher suites, but also includes some that are considered obsolete or weak. Weak encryption algorithms in TLS 1.2 include NULL, RC2, RC4, DES, IDEA, and TDES/3DES, and cipher suites using these algorithms should not be used.","riskDetails":"Supporting weak cipher suites in TLS 1.2 means that attackers can attempt to force the usage of these cipher suites, even when secure ciphers are also available. Exploiting weak cipher suites can be used by hackers to eavesdrop on communications, intercept data, and launch adversary-in-the-middle attacks.","recommendedRemediation":"TLS 1.3 no longer includes the weak cipher suites available in 1.2. Upgrading to 1.3 will resolve the issue. Within 1.2, compare the list of cipher suites in use to the list at ciphersuite.info/cs to identify which are insecure.","knownExploitedVulnCount":0,"checkID":"ssl_weak_cipher","category":"ssl","controlCheckID":"IM.EN.SE.KA","passTitle":"No weak cipher suites supported in TLS 1.2","passDescription":"TLS connections to the site do not support any weak cipher suites.","passGroupDescription":"TLS connections to all sites do not support any weak cipher suites.","failTitle":"Weak cipher suites supported in TLS 1.2","failDescription":"Weak cipher suites can potentially be broken by a well resourced attacker, and should not be supported by the server unless very old devices or browsers must be supported.","remediation":"Ensure the server only supports secure cipher suites.","issue":"The impacted domains support weak cipher suites in TLS 1.2.","recommendation":"Ensure only secure ciphers are supported by the server.","defaultSeverity":1,"categoryTotalCost":0,"overrideContext":null,"Deprecated":false,"ISOControls":["A.14.1.3"],"ISO2022Controls":["8.12"],"NISTControls":["PR.AC-5","PR.DS-2","PR.DS-5","PR.DS-6","PR.PT-4"],"ExcludeFromHardcodedPassedRisks":false,"Summary":"Transport Layer Security (TLS) 1.2 supports several strong cipher suites, but also includes some that are considered obsolete or weak. Weak encryption algorithms in TLS 1.2 include NULL, RC2, RC4, DES, IDEA, and TDES/3DES, and cipher suites using these algorithms should not be used.","RiskDetails":"Supporting weak cipher suites in TLS 1.2 means that attackers can attempt to force the usage of these cipher suites, even when secure ciphers are also available. Exploiting weak cipher suites can be used by hackers to eavesdrop on communications, intercept data, and launch adversary-in-the-middle attacks.","RecommendedRemediation":"TLS 1.3 no longer includes the weak cipher suites available in 1.2. Upgrading to 1.3 will resolve the issue. Within 1.2, compare the list of cipher suites in use to the list at ciphersuite.info/cs to identify which are insecure."}]},"cstarScore":903,"publicScore":828,"vendorName":"Roblox","name":"Roblox","display_name":"Roblox","vendorId":6350435984080896,"business":{"employees":1600,"marketCap":92569271910,"revenue":3600000000},"address":{"city":"San Mateo","state":"CA","country":"United States","countryCode":"US"},"ceo":{"name":"David Baszucki","imgUrl":"https://media.glassdoor.com/people/sqll/242265/roblox-ceo1517979273958.png","approvalRating":63},"primaryHostname":"roblox.com"}