Games are susceptible to repeated DDoS attacks, resulting in >86% playercount decrease in my game

Dr_Luxxe · August 10, 2026, 2:03am

Synopsis

I believe that my game is a target of frequent DDoS attacks. These services are monetizing the crashing of Roblox games.

Example of an illicit server’s pricing page, specifically designed for DDoSing Roblox games

Our playercount after these attacks started has dropped from peaks of around 200 to lows of 20 during the attacks.

Some of these services are attached in a private report to support investigation (not shared publicly to prevent spreading of the servers).

Supporting information

I understand that it is definitely possible that an exploiter could be crashing my game through RemoteEvent spam or other issues. However, I believe this is not the case because of the following reasons:

Similar games are being crashed at the same time as our game, indicating a universal exploit.
The crashes only happen to our main servers, not any private servers or reserved servers that are rank locked.
The servers sometimes last for days, but once an attack is initiated the servers repeatedly crash for the duration of the attack before returning to normal.

Additionally, we had locked our game temporarily to only returning players and the attacks continued, supporting evidence that exploiters did not need to be inside of the game. We also scanned all players and had extensive RemoteEvent logging and a large staff presence inspecting and removing any suspicious players. Alas, the server crashed still. I believe this is further evidence that they are utilizing a UDMUX bypass exploit, as they must receive the game server IP from the roblox server page

For more context, our game is a game revolving around a high playercount per server, but centralized in one server, making it particularly vulnerable to attacks like these.

Crash Images

Supplied by players of the game.

Playercount data

Playercount graph after attacks started - players can be seen being crashed and attempting to rejoin multiple times

Typical playercount graph (~4 days ago)

Possible mitigations

If possible, I would really appreciate getting a DDoS protected server, as I believe similar games have received this in the past.

I also understand there are some mitigations to make it more difficult to DDoS like making a server browser, but this would be easily bypassable if a malicious actor navigated into the primary server, thus receiving the IP of the game server and then being able to crash it.

A private message is associated with this bug report

Dr_Luxxe · August 10, 2026, 8:05pm

I have been gathering more information on how these tools work and am attaching more information in the private message of this report.

Our game is working on a server browser system, which is what we encourage other games to develop if you are being attacked by these services.

The way most of these services work is by utilizing the Place ID, Access Code, and a Teleport Token. It makes it harder for these services to impact your game if you implement a server browser system, where they would need someone to manually join the hub server and navigate to the primary server to get information about it. Additionally, we are going to be implementing mitigations to isolate suspicious players from the rest of the main server to alleviate the issue further.

Gods_Chief · August 11, 2026, 8:39am

Currently experiencing the same issue, not sure where to go but they got my game.

R14GENIE · August 11, 2026, 9:13am

Having the same issue, so the exploit is already running wild, they have destroy our server this night.

It become really urgent to patch it.

Gods_Chief · August 11, 2026, 10:28am

Hopefully roblox can do something about this, i had to shutdown my game and hopefully wait out and see if roblox drops some sort of update.

Attroxide · August 11, 2026, 12:49pm

I’ve been looking into this with Gods_Chief

The exploiters are doing it en-masse. One of them are in the server /home which seems to be a private community server with 13 exploiters in, these are the people behind the attack from my knowledge.

I have been told by one of the exploiters that are doing this to 5+ games per day, exploiting each for $200

They are doing this via a genuine roblox engine bug, I had the exploiter reproduce this in a completely empty baseplate and they were able to make the game not joinable after around 1-2 mins.

When it happens users are kicked with a “Network Failed” error, checking server console this is the only error fired approx 10-15s before crash

@DevRelationsTeam This is serious and affecting primarily small games, please look into it urgently.

Sonostrano20 · August 11, 2026, 1:03pm

Agree with you,

Same happening to me and some others people: [URGENT] Increasing Platform Crashes // Ddos - #2 by Sonostrano20

Attroxide · August 11, 2026, 1:11pm

@moderators
This needs to be escalated immediately! More and more games being affected by the hour and potentially thousands of USD of creator revenue at risk due to a genuine ROBLOX engine bug!

Quenty · August 12, 2026, 6:08am

Someone did this to egg hunt too, all they need is the IP address of the server.

Gods_Chief · August 12, 2026, 6:33am

The best thing developers can do at this moment is flat out ignore them and ride out the bot wave. Still waiting for a staff member to address this though as more people are beginning to complain

R14GENIE · August 12, 2026, 7:20am

I dump this, this become an extreme urgent matter, they found out how to attack server behind hub. I have put in place a hub yesterday, give us few hours of calm, now they are attacking us again.

They are trying to destroy our game.

Please move quick and fast.

xChris_vC · August 12, 2026, 9:44am

What if you automatically teleport players to a reserved instance upon join (as temporary mitigation)? Do these services grab the IP address from the initial handshake or does a bot player join the game?

Would need to make the servers tab in-game then, but at least we can route new / high-risk players to a different instance than the existing playerbase.

Enr7se · August 12, 2026, 1:19pm

I am pretty sure mitigations are already in the works. Since Roblox recently strengthened its defenses, these attacks now focus on spamming massive amounts of packets across the server’s entire /24 subnet (carpet-bombing the subnetwork). As a result, a single attack ends up taking down tens to hundreds of servers just as collateral damage

voostii · August 12, 2026, 6:40pm

Happening over here in my game as well and they attempting to get into contact with us basically begging us for money or else they wont stop doing it and we will suffer forever lol. 1k CCU’s down to 0.

Dr_Luxxe · August 12, 2026, 6:59pm

I have done further research and it varies widely on the tool they are using. Typically, they have a bot quickly request to join but cancel the join request, and for those games with servers like that it is incredibly easy to DDoS. There are services that have millions of cookies of accounts to get the IPs to be able to crash thousands of servers at once (varies depending on their botnets bandwidth).

However, we have noticed a significant reduction in DDoS attack success after creating a simple teleport hub that uses reserved servers. We also added a system to put users into different pools based off of trust levels.

I believe this issue is still ongoing, but adding a server browser or even a teleport hub helps a lot as the DDoSers typically need to have special capabilities to run a DDoS from a reserved server.

voostii · August 12, 2026, 7:07pm

We did the teleport hub. Will do other implementations like you stated. However game is still down and we are being threatened to send them 500 dollars or else it will “never stop” and they keep taunting us haha it’s so funny and sad at the same time.

Dr_Luxxe · August 12, 2026, 8:51pm

Feel free to contact me personally if you’d like any help on stuff, the recommendations I’d give vary game to game.

For example, our game typically gets 150-200 players at our peaks in one single server, which makes it a very good target for DDoS attacks. Because of this nature we set up a pool for suspicious accounts to get sent to their own server, and for normal looking accounts to get put in a new server. I’d suggest against checking things like account age (as these DDoSers have many cookies of aged accounts), and instead use other factors such as VerifiedLevel | Documentation - Roblox Creator Hub, playtime, and other things. Feel free to PM me if you have a game that’s being affected and I can give you a list of things that you can check for to filter out potential bot accounts.

I would also suggest against kicking suspicious accounts, and instead have proper matchmaking to put them in a separate server. This is because new players will likely get categorized as suspicious accounts, and you don’t want to shut off an audience to your game.

I believe Roblox has been pushing out some changes to stop some attacks, although I’m not totally sure. I have been given reports that some DDoS services have been offline because their method got patched, and other services are starting to increase their cooldowns because of our reports on the devforum. My #1 suggestion is to implement a reserved server system to make your game less vulnerable. It won’t make your game impossible to DDoS, but it will make it harder which ultimately lowers your chances of getting knocked offline.

NoArtificalSweetner · August 13, 2026, 2:32am

Our game utilizes a server browser and our servers have still been getting crashed nonstop.

We recently swapped from “Limited to same Universe” to “Secure within Universe only” in an attempt to mediate this.

Dr_Luxxe · August 13, 2026, 3:04am

Yes, your protected place must be secure within universe only. Without it, it is much easier for them to obtain access to your server.

R14GENIE · August 13, 2026, 3:35pm

Doesn’t work we have a hub, they found a way to bypass.