Overview
Roblox is generally known for keeping its servers secure, with measures like UDMUX and Byfron. However, a critical exploit has surfaced that needs immediate attention. Recently, my friend became a victim of extortion from attackers exploiting this vulnerability.
Incident Summary
On August 11th, we noticed repeated server crashes — all players would suddenly disconnect due to “lost internet connection.” Initially, we suspected in-game vulnerabilities and removed certain systems, but the issue persisted.
Later, we received a direct message from someone named “a simple train” claiming responsibility for the DDoS attacks. They demanded $400/month to “whitelist” our game so that no one could target it.
How the Exploit Works
While we cannot confirm the exact method, we obtained a video showing the attacker using the command /snipe <username> in a Discord bot. Moments later, the targeted Roblox server crashed.
Further investigation with community contacts revealed that:
This vulnerability is old and is currently being sold for ~$70/week.
To crash the server, an attacker makes so that anyone can join him, joins the game, and executes a command /snipe .
The bot is connected to a botnet, which likely abuses a Roblox API vulnerability (possibly related to the “Join profile” process).
Tens of thousands of malicious join requests are sent with unexpected parameters, overwhelming the game’s hosting server.
This vulnerability exist since november 2024 and still hasn’t been fixed.
What to Do if You’re Targeted Do NOT pay the attacker. Paying will not stop the attacks — it will only encourage them to demand more money.
Server Isolation System
Player joins main game.
Player is immediately teleported to a private server.
UI appears with a server list where they can join or create servers.
This prevents attackers from hitting the main server directly (though they can still crash a private one).
Account Trust Verification
Add a second layer of defense:
Check owned accessories.
Check groups, badges, and friends.
Verify if the email is confirmed.
Apply a trust score and deny entry if suspicious.
Note: Some attackers sell methods to bypass server isolation, but these are far less common and expensive. Combining multiple defense layers makes attacks significantly harder.
you don’t have any proofs of this actually working as you describe. Nothing happens in the video you attached, screenshots just show a random whose words have no value. Won’t be surprised if it’s just a problem with remote events/functions in your game
No, it’s a genuine issue that many games are being affected by. This isn’t related to poor remote security. Discord bots made to crash roblox games (either through a /snipe command, or even taking a place ID + jobid) have existed for a while now.
The video you provided didn’t seem to show any real proof. If there is to be any real proof for the severity of this, it should be done in a popular front-page game (to show that it can happen to any game) and done on the account recording the video.
If it does work, they are most likely egotistical edgelords acting as a middleman service for a darknet DDoS service. Although, I highly doubt that these cringe skids are actually capable of doing this.
The video literally shows the ping updating normally and then freezing - that’s the server not responding.
I don’t know what “proofs” you need if this isn’t enough for you
I noticed that it looks like the ping goes back to updating normally, and the client isn’t kicked. Correct me if I’m wrong, but if this was real, wouldn’t Roblox kick you? Completely agree that it’s probably faked with a program like that.
just checked and it takes exactly 20 seconds of server not responding for client to get kicked with timed out reason. On the video provided, player spent whole 30 seconds on the server after bot processed /snipe command.
I’ve been getting attacks as well. An exploiter showcased me how he got my job id and then ran a command to crash it. Shortly after, the server ping froze completely (almost instantly) and it took a few seconds to see players disconnecting (not all of them). How could he achieve this ? I tried spamming my remote events with absurdly big tables and it rarely got my server ping up.
I’ve added a rate limiter since then and i’m waiting to be targeted again.
Also, I don’t remember seeing any errors indicating to the spam of remote events, nor joins prior or during the attack. (other than of course, the account he used to gather the info which was banned right after)
Finishing with a question, if hypothetically it is a real ddos attack – can it be done with only the job id from the server he wants to crash?
says nothing to me until you get footage of this actually working.
the original post (and others similar to it) has no value as “bug report” exactly because it has no proofs of this actually working or happening
Other posts have provided enough proof to sustain their point. Exploiters can just crash servers with a simple command. I was asking, how can they do it ? I saw you denying the method showed in the video, but then, how are they doing it ? How can we prevent it ?
