X
Campaign documented
Xeno
A public GitHub repository and a Bitdefender report. The profile compares the loader the repository describes with the loader the fake installer replaced.
volt — status strip
The name, the site, the pricing
Volt operates through voltbz.net, which hosts release notes for version 1.3 . ScriptBlox records a $5.99 weekly price and a release cadence measured in days, not months . Rscripts records 42.1K downloads and a "Verified by Rscripts" badge .
Those are the visible changes: a new domain, a current release, an active tracker listing. They are easy to verify because they are public.
domain: voltbz.net
version: 1.3.17.2
tracker: Rscripts
The developer continuity
ScriptBlox's editorial notes contain the sentence that matters: "While under the AWP.GG name, this exploit had a long downtime period, but after rebranding (And possibly switching developers), all existing users were compensated" .
"Possibly switching developers" is the tracker's own uncertainty. It is not a confirmation. It is a recorded gap. The compensation of existing users suggests a commercial transition, not a clean technical continuation.
developer: possibly changed
compensation: recorded, not detailed
The one independent signal
Triage, a public sandbox, records a sample named Volt Executor.exe with a score of 7/10. The behavioral notes say it "executes dropped EXE" and "checks installed software on the system" by looking up Uninstall registry keys .
A 7/10 score is not a malware verdict. It is a behavioral observation from a sandbox. It is also the only signal in this profile that comes from outside the executor's own ecosystem.
Triage: 7/10
behavior: dropped EXE
sUNC 100%
Developer continuity unresolved
Triage 7/10
checked 2026-10-21
Sources: ScriptBlox Volt profile · Rscripts Volt page · voltbz.net release notes · Triage sample 260605-y666wsey3n . The Triage score is behavioral, not a malware classification.
What the rebrand actually tells you
A rebrand is a marketing event. It changes the name, the domain, and sometimes the pricing. It does not, by itself, change who writes the code, who builds the binary, or who controls the update pipeline.
ScriptBlox's note is unusual because it records the uncertainty instead of hiding it. "Possibly switching developers" means the tracker cannot confirm that the team behind AWP.GG is the same team behind Volt. The compensation of existing users is consistent with a sale or a handover. It is not proof of one .
The practical consequence: a 100% sUNC score from Volt tells you the function coverage is complete. It does not tell you who is responsible for the executable that provides that coverage. Those are separate questions, and the tracker only answers the first one.
What the Triage score adds — and does not add
Triage's 7/10 score is a behavioral observation. The sandbox saw the sample execute a dropped executable and query installed software via the registry . Those behaviors are consistent with both a legitimate installer and a malicious loader. The score does not distinguish between them.
What it does is provide a signal from outside the executor's own documentation. ScriptBlox, Rscripts, and voltbz.net are all part of the same ecosystem. Triage is not. A 7/10 score is not a warning label. It is a data point that exists independently of the marketing.
The release trail, as recorded
ScriptBlox records a dense release cadence for Volt under the new name. These are tracker timestamps, not a developer changelog. They show the project is active. They do not show what changed in the binary .
| Version | Approx. age | Roblox build | Source |
|---|---|---|---|
| 1.3.17.2 | 1 day | 7a0c6d10fcb3 | ScriptBlox |
| 1.3.16.3 | 1 week | cec3ad5889b4 | ScriptBlox |
| 1.3.15.1 | 2 weeks | 02c37bc51a38 | ScriptBlox |
| 1.3.14.1 | 3 weeks | 2366ba214ec7 | ScriptBlox |
| 1.3.13.1 | 4 weeks | 4310300497aa | ScriptBlox |
Version numbers and dates are recorded by ScriptBlox. This page does not claim any build is safe or undetected.
What this page does not claim
- This page does not claim Volt is a scam. The rebrand and compensation are consistent with a commercial transition, not fraud.
- This page does not claim the original AWP.GG developers are still involved. "Possibly switching developers" is the only public phrasing available, and it is ambiguous .
- This page does not claim the Triage 7/10 score proves Volt is malicious. The behaviors observed — dropped EXE execution, registry queries — are consistent with both legitimate installers and malware .
Volt questions, without the marketing
Is Volt the same as AWP.GG?
Volt is the current name. ScriptBlox states the project operated as AWP.GG previously and underwent a rebrand, with existing users compensated during the transition . The public record does not confirm whether the development team is identical.
What does the Triage 7/10 score actually mean?
Triage is a public sandbox. The score reflects observed behavior: the sample executed a dropped executable and queried installed software via the registry . A 7/10 score is a behavioral signal, not a malware classification. It is the only independent signal in this profile that does not come from the executor's own ecosystem.
Does 100% sUNC mean Volt is safe?
No. sUNC measures function coverage. Volt passes every function in the test suite . That means scripts that call those functions will run. It says nothing about the loader, the update mechanism, or the payload.
Why does ScriptBlox say "possibly switching developers"?
Because the tracker cannot confirm it either way. The phrasing is unusually honest for a tracker. It records the uncertainty instead of resolving it. The compensation of existing users suggests a handover, but a handover is not a confirmation of who is building the binary now .
Can I download Volt from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from Wave's?
Because the evidence is shaped differently. Wave has four parallel tracker signals that needed to be separated. Volt has a status strip, a timeline of name changes, and one independent sandbox signal. The layout follows the evidence: a top strip for current status, tabs for what changed and what did not, and a bottom bar for the independent signal.