Network inventory · evidence by version
This is the network map for Luczystrap—not a generic list of domains. It separates traffic attributed to the official 1.4.9 process, routes found in public 1.3 code, optional integrations, and unresolved artifacts.
setup.rbxcdn.com, api.github.com, and clientsettingscdn.roblox.com. That is a verified minimum, not a complete firewall allowlist: the run did not exercise every feature.Scope: one automated startup workflow. The report counted 11 HTTP(S) requests overall, including unrelated Windows processes.
01 / What the current capture proves
The sample hash matches the official GitHub 1.4.9 asset. ANY.RUN enabled networking and a MITM proxy, ran the task for 150 seconds, and reported connections by process. It also warns that sandbox results can be affected by the environment and user actions.
setup.rbxcdn.com/version and a version-specific package manifest returned successfully.
GitHub’s public latest-release route returned metadata for Luc6i/Luczystrap.
The WindowsPlayer version endpoint on clientsettingscdn.roblox.com returned successfully.
The sandbox did not join a Roblox server, enable location or uptime, use Account Switcher, install plugins, run custom integrations, or exercise every update and fallback path.
Conditional endpoints may remain dormant until their setting or workflow is used.
The public table establishes routes and methods, not a complete field-by-field body for every request.
Service hosts and application behavior can change in a later release.
02 / Endpoint inspector
The inspector answers six practical questions: who owns the service, what triggers it, which identifiers may leave the PC, whether it is optional, and which version establishes the claim.
Endpoint or transport
The current sandbox observed a version check and a package-manifest request. Historical code used the same service family to test connectivity, choose a working deployment host, retrieve manifests, and download Roblox packages.
https://setup.rbxcdn.com/version · /version-{guid}-rbxPkgManifest.txtDecision: treat as functional traffic for Roblox deployment. Do not label it analytics.
03 / Full working inventory
Rows marked “observed” were attributed to the current process in the public 1.4.9 run. Historical rows come from public tag 1.3. “Unresolved” means the artifact exists but its runtime behavior has not been explained.
| Host / transport | Purpose | Request context | Control or failure | Evidence |
|---|---|---|---|---|
| setup.rbxcdn.com | Roblox version, manifest and packages | GET version and version-specific manifest observed | Blocking can break detection, install or update | 1.4.9 observed |
| api.github.com | Latest Luczystrap release metadata | GET public repository latest-release route observed | May disable or break the update check; exact current toggle unverified | 1.4.9 observed |
| clientsettingscdn.roblox.com | Current WindowsPlayer version | GET client-version route observed | Blocking can prevent Roblox version resolution | 1.4.9 observed |
| setup-aws.rbxcdn.com setup-ak.rbxcdn.com roblox-setup.cachefly.net s3.amazonaws.com/setup.roblox.com | Fallback Roblox deployment mirrors | Historical connectivity tests, manifests and packages | May be contacted when the preferred host fails | 1.3 source |
| clientsettings.roblox.com | Fallback client-version and settings service | Historical fallback after CDN request failure | Blocking removes that fallback path | 1.3 source |
| config.luczystrap.app | Remote project data cached as Data.json | Historical GET on startup unless ForceLocalData was enabled | Historical ForceLocalData used the local copy; current host/status unverified | 1.3 source |
| games.roblox.com thumbnails.roblox.com | Experience metadata, icons and thumbnails | Universe/place IDs and thumbnail request objects | Disable activity/presence context; images or game details may disappear | 1.3 source |
| users.roblox.com | User details and historical Account Switcher validation | User ID; authenticated route historically received the session cookie header | Do not use Account Switcher or enter .ROBLOSECURITY | 1.3 source |
| ipinfo.io | Approximate Roblox server location | Roblox server IP embedded in the lookup path; city/region/country returned | Leave server details/location off | Optional · 1.3 |
| apis.rovalra.com | Estimated server first-seen time | GET and POST with place ID and server/job ID | Leave server uptime off | Optional · 1.3 |
| Discord desktop RPC | Publish Rich Presence locally to Discord | Experience, session time, images; optional account and join context | Disable Rich Presence and its optional fields | Optional · 1.3 |
| discord.com/api/webhooks/… | Purpose and payload not disclosed | Credential-like artifact reported statically; no matching runtime request shown | Not suitable for an allowlist until the maintainer explains and removes or rotates it | Unresolved 1.4.9 |
This inventory intentionally excludes documentation links opened by a user, such as Discord invites, help pages and source links. It also excludes endpoints belonging only to unrelated Windows processes in the sandbox.
04 / Process attribution
The sandbox recorded network activity from several processes. Counting every DNS request on the virtual machine as Luczystrap behavior would falsely assign Windows activation, certificate checks and search traffic to the app.
Use the process column. A domain list without process ownership, workflow timing and a clean baseline is not an endpoint audit.
Roblox deployment CDN, GitHub API and Roblox client-settings CDN.
crl.microsoft.com belonged to Windows service activity, not the Luczystrap process.
The Microsoft activation route was associated with the Windows activation client.
Bing traffic belonged to the Windows Search application in the sandbox.
Keep it unassigned until a repeatable workflow and process owner establish the source.
05 / Allow or block
A firewall is useful for testing, but a static allowlist can age quickly. Start by disabling the feature that creates the route, then use a temporary network rule to confirm the result.
Deployment CDN and client-version services support installing and updating Roblox. GitHub supplies Luczystrap release metadata. Blocking these routes can trade privacy for broken updates or launches.
Server location, uptime, Discord presence, Account Switcher, plugins and custom integrations have separate data surfaces. Leave each off unless its benefit is intentional.
The reported embedded webhook needs an owner explanation, field list, trigger, consent rule and retention statement. A static detection is not proof of use, but it is not an allowlist entry either.
06 / Reproduce on Windows
Use Windows Packet Monitor for the packet record and Microsoft Sysinternals TCPView for process ownership. Test a clean startup first, then repeat separately for install/update, launch, Discord, location, uptime and any plugin.
Keep raw captures private. A system-wide PCAP can include unrelated domains, IP addresses, query parameters and session material. Share a redacted host-and-purpose table, not the original capture.
Close browsers, launchers and chat clients you are not testing. Verify the EXE hash and note the exact settings state. Open TCPView and filter for Luczystrap.exe.
Open Terminal as Administrator. Full packets are useful for analysis but increase sensitivity.
pktmon start --capture --pkt-size 0 --file-name C:\Temp\luczystrap.etlFor example: open Luczystrap and wait 60 seconds. Do not install, join a game and enable Discord in the same run. A narrow workflow makes each connection explainable.
pktmon stoppktmon etl2pcap C:\Temp\luczystrap.etl --out C:\Temp\luczystrap.pcapngMatch TCPView’s process-owned connections to the capture time. Compare against the idle baseline. Record host, method, path category, trigger and control; remove tokens, cookies, user IDs, job IDs and unrelated traffic.
07 / FAQ
The short answer is rarely “allow” or “block.” The route, process, workflow, transmitted field and current version all matter.
A 150-second public sandbox run of the official 1.4.9 SHA-256 attributed three hosts to Luczystrap.exe: setup.rbxcdn.com, api.github.com and clientsettingscdn.roblox.com. That run did not exercise every feature, so it is a verified minimum, not a complete allowlist.
The observed requests checked the Roblox deployment version and retrieved a package manifest. Historical code also used Roblox setup CDN hosts for connectivity tests, manifests and package downloads required to install or update the official Roblox client.
The observed 1.4.9 request used GitHub’s public latest-release endpoint for the Luc6i/Luczystrap repository. It returned public release metadata used to check the latest Luczystrap version.
Historical 1.3 code used ipinfo.io for approximate Roblox server location and RoValra for estimated server uptime. Neither host appeared in the short 1.4.9 sandbox run, which did not prove those features absent. Leave server details and uptime off if you do not want those optional lookups.
Historical Luczystrap Rich Presence communicated locally with the running Discord desktop client through RPC. Discord then handles its own network synchronization. A domain-only firewall list therefore does not fully describe the data shown on a Discord profile. See the Discord privacy guide for field controls.
An automated static rule reported an embedded Discord webhook credential in the official 1.4.9 file, but the public sandbox network table did not record a webhook request from Luczystrap during its short run. Its purpose, trigger, payload and current validity remain unresolved. The credential is intentionally not reproduced here.
You can block network access, but installation, Roblox version checks, package downloads and Luczystrap update checks may fail. Disable optional features first. Do not treat the three observed hosts as a permanent or complete firewall allowlist.
On Windows 10 or 11, use the built-in pktmon tool to capture one controlled workflow and Microsoft Sysinternals TCPView to identify the process owning each connection. Keep the raw capture private because it may contain unrelated traffic, IP addresses or session data.
08 / Inspectable evidence
Current runtime observation and historical code answer different questions. Both are linked. Third-party service documentation explains the mechanics without inventing Luczystrap behavior.
Checked August 6, 2026. The latest official GitHub release remained 1.4.9, published November 5, 2025. The current app source was still unavailable, so this page does not claim that the historical list is identical to the current binary or that a single sandbox run exercised every route. The reported webhook credential is omitted to avoid redistributing a secret.