Using Unicode to copy group names
Recently, many games have been impersonating popular users on Roblox to trick users into thinking they’re actually visiting a legitimate game. They do this by using Unicode homoglyphs to make the fraudulent group names look exactly like what they’re copying.
These characters are almost indistinguishable from the original group/user on the game page on the website, mobile app and desktop app.
This wouldn’t be as much of a problem with display names, as players know they can be copied, but as a group name is unique, victims are tricked into thinking the group is legitimate. Some of the groups using this method have hundreds of thousands of members.
Malicious Use
One example of a victim is haz3mn, the creator of Pls Donate:
| Group | Name | Unicode used | Locked |
|---|---|---|---|
| https://www.roblox.com/groups/34256955/haz3mn#!/about | haz3mnᅠᅠ |
HANGUL JUNGSEONG FILLER at end of name |  |
| https://www.roblox.com/groups/34256960/Haz3m#!/about | Haz3mᅠᅠ |
HANGUL JUNGSEONG FILLER at end of name |  |
| https://www.roblox.com/groups/33143812/az3mn#!/about | һaz3mn |
CYRILLIC SMALL LETTER SHHA replacing the H
|
|
| https://www.roblox.com/groups/33143771/azem#!/about | һazem |
CYRILLIC SMALL LETTER SHHA replacing the H
|
|
| https://www.roblox.com/groups/33966341/h-zemn#!/about | hаzemn |
CYRILLIC SMALL LETTER A replacing A
|
|
| https://www.roblox.com/groups/33086123/h-z3m#!/about | hαz3m |
GREEK SMALL LETTER ALPHA replacing a
|
|
| https://www.roblox.com/groups/33885496/h-z3mn#!/about | häz3mn |
DIAERESIS added to the a character |
|
Also note that all of these groups are hosting “Dice” games that pretend to give away Robux.
Other examples of Unicode use
Not sure if all of these groups are intended to be used maliciously, but they are still impersonating.
- Scriptbloxiаn Studios - Roblox
- Uplift Gаmes - Roblox
- Rօblοx - Roblox
- Dа Hооd Еntеrtаinmеnt - Roblox
- Bаdimо - Roblox
- haz3мn - Roblox
Steps to replicate:
- Go to the Groups page.
- Find a Unicode character that isn’t moderated, and add it after or within the name.
- Create the group.
I have been able to replicate this easily with Cyrillic characters, with the group names passing moderation and duplicate checks.
An example group I created would be Dress To Impress Grоup - Roblox. I simply replaced the o in Group with a CYRILLIC SMALL LETTER O.
How would this be fixed?
This is a tricky problem to fix, as hundreds of groups legitimately use Cyrillic characters and other Unicode to make their name appear “pretty”. One possible solutions is checking all new generated groups for homoglyphs, or “confusables”, using a Unicode list, but I understand that adding a feature to the codebase is easier said than done.