We are actively investigating now. Thank you all!
10 Likes
For now, I would advise everyone to block no-reply@roblox.com and only unblock them when you are expecting an email, such as for 2FA. Hopefully this will all be sorted out soon!
3 Likes
Iâm just sending all emails from roblox to a folder called âroblox spamâ lol. I created a gmail filter to do it for me automatically.
2 Likes
Itd be neat if we could see the IP of the computer that requested the password reset, so its not as obscure. This would also discourage some people from doing it
1 Like
They probably arenât allowed to do that.
Iâm just curious to know how these bots got our emails in the first place, and why this isnât setting off any spam filters automatically.
2 Likes
Canât you request a password reset with only a username?
Didnât you used to be able to request a reset with a username in the past? Maybe that endpoint is still functional.
My guess is they scraped the DevForum for names and did just that.
2 Likes
You can. If youâre on gmail, click âshow originalâ.
I guess that sounds plausible, but it doesnât explain the randomly varying letter case in the emails being sent to me. It almost seems like the email address is being targeted directly somehow.
2 Likes
Getting spammed down as we speak. Iâm surprised over how they know my email.
Just started receiving password reset emails. Hope this gets fixed soon.
I just refreshed my email and got three of these, too. However, I read this thread this morning and immediately thought of Cloneâs issue.
I have 2FA enabled, but no PIN.
The only other thing I can think of is that they somehow got into the DevForumâs underbelly and got the emails that way.
2 Likes
They do not know emails. I changed mine and Iâm still receiving them. There must be an endpoint that doesnât require it.
1 Like
~~This could be bad, if they are able to get everyoneâs emails, this means that Roblox is effectively a giant document of free emails to use for spamming and phishing emails. This is collection #1 all over again. I wouldnât be surprised if Roblox showed up on this site soon: Have I Been Pwned: Page not found
Confirmed it was Username based
@Reshiram110 That gives you the IP of Robloxâs mail server, not the IP address of the person requesting the password reset.
Thatâs what Iâm thinking. But why are they spamming it in the first place? They have nothing to gain by doing this.
1 Like
I know, but itâs the same mail server sending me the emails, so weâve narrowed down the server that is causing the issue (at least for me, anyways).
If the engineers can get access to the server they can probably do a backwards network trace from there to see what endpoints are accessing it, and who is accessing said endpoints.
Perhaps it is just boredom.
Either way, whoever is doing it I hope they get caught.
1 Like
Theyâve actually got quite a bit to gain. By spamming a mail server like this, you can get it to send out very sensitive data in the form of errors, this gives exploiters insight into how the system works, potentially leading to an exploit that will expose very important information, such as the keys used in password reset tickets.
1 Like
Seems patched now. Roblox must have deactivated the old endpoint. Emails werenât leaked, they used an old endpoint that required a username.
18 Likes
Shucks just found it on the way back machine. Guess I canât test it but glad itâs fixed finally.
1 Like