SH
Detected
SirHurt
100% sUNC and Detected. Four separate measurements, including a sandbox score and a domain reputation flag.
real — record
v2.7.6
free
sUNC 100%
Detected
Coverage
100% sUNC · 99% UNC
Every standard function in the sUNC suite passes. One function is missing from the UNC set . A script that uses the sUNC functions will run. A script that depends on the one missing UNC function will not.
Detection
Detected
ScriptBunker marks the build as Detected. This is a game-security signal, not a malware verdict. It means the anti-cheat recognizes the executor. Using it carries a ban risk. ScriptBunker itself notes that "not marked detected" is not a guarantee of safety .
Distribution
Free · Key system · projectreal.gg
Rscripts states that PROJECTREAL.GG is the only official domain for Real . The executor uses a key system: you complete a short checkpoint on the official site to get a key, then paste it into the executor . Free daily keys are available.
Sandbox flag
8/10 · revoked certificate
Triage scored one Real Executor sample at 8/10. The behavioral notes are sparse, but the signature analysis records a specific flag: "Revoked Certificate in Chain" and "Untrusted Codesign Signers" . A revoked certificate in the signing chain indicates the certificate used to sign the file was revoked, often because it was compromised or misused. This is not a malware classification. It is a code-signing integrity flag.
What is not known
—
No domain reputation scan for projectreal.gg was reviewed here. A separate GitHub Pages site, real-executor.github.io, is flagged by three security vendors as malicious and phishing , but it is not the official domain listed by Rscripts. The two should not be confused.
This page records three facts and two flags. It does not fill the gaps with speculation.
Why a short page is the honest page here
Most executor profiles have something to explain: a rebrand, a team change, a malware campaign, a distribution model. Real has a tracker record, a domain, and a single sandbox sample. That is the entire public evidence set reviewed here.
A longer page would require inventing context. A narrative about the "history" of Real would have to be constructed from nothing. A comparison to other free executors would be speculation about which one is "better" without a basis for the comparison.
The absence of a documented malware campaign does not mean Real is safe. It means no campaign was documented in the sources reviewed. The absence of a domain scan does not mean the domain is clean. It means no scan was found. Unknown is a description of the record, not a verdict on the executor.
What the Triage flag actually means
Triage's 8/10 score is a behavioral observation from a public sandbox . The signature analysis records a specific technical finding: a revoked certificate in the chain, and an untrusted codesign signer . A revoked certificate means the certificate authority invalidated the certificate after it was issued. This can happen for several reasons, including compromise of the signing key.
The flag does not prove the executable is malicious. It proves the code-signing chain is broken. A broken chain is a traceability problem: you cannot verify that the file was signed by the entity it claims to represent. The sUNC score measures functions. The Triage flag measures signature integrity. They are separate measurements.
The record, in one table
| Attribute | Value | Source type | Confidence |
|---|---|---|---|
| Version | 2.7.6 | Third-party tracker | Recorded |
| sUNC | 100% | Third-party tracker | Recorded |
| UNC | 99% | Third-party tracker | Recorded |
| Detection | Detected | Third-party tracker | Recorded |
| Price | Free | Third-party tracker | Recorded |
| Official domain | projectreal.gg | Rscripts | Recorded |
| Sandbox score | 8/10 | Triage | Recorded |
| Signing chain | Revoked cert | Triage | Flagged |
"Recorded" means the source published the value. "Flagged" means the source observed a technical issue. Neither is a safety rating.
What this page does not claim
- This page does not claim Real is safe. It records a coverage score, a detection flag, and a code-signing flag from separate sources.
- This page does not claim the Triage 8/10 score or the revoked certificate proves Real is malware. A revoked certificate is a traceability failure, not a malware classification .
- This page does not claim the GitHub Pages site
real-executor.github.iois related to Real. It is flagged as malicious by three security vendors , but it is not the official domain listed by Rscripts. The official domain isprojectreal.gg.
Real questions, answered without padding
Does 100% sUNC mean every script works?
No. It means every function in the sUNC test suite passes . A script that uses those functions will run. A script that depends on a function outside the suite, or on a specific Roblox API behavior, may still fail.
What does the Triage 8/10 score and revoked certificate mean?
Triage scored one sample at 8/10 and flagged a revoked certificate in the signing chain . A revoked certificate means the code-signing identity cannot be verified. It does not prove the file is malicious. It proves the chain is broken.
Is real-executor.github.io the official Real site?
No. Rscripts states that PROJECTREAL.GG is the only official domain for Real . The GitHub Pages site real-executor.github.io is flagged by three security vendors as malicious and phishing , but it is a separate, unofficial page.
Does Real have a key system?
Yes. Rscripts describes a key system: you complete a short checkpoint on the official site to get a key, then paste it into the executor . Free daily keys are available, and Plus/Pro keys are sold through verified resellers.
Can I download Real from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from SirHurt's?
Because the evidence is thinner. SirHurt had four separate measurements from four separate sources. Real has three tracker facts, one official domain, and one sandbox flag. The layout uses a minimalist record format with generous spacing and a single column, because a complex layout would imply more evidence than exists.