What is RoSync?

Help and Feedback Scripting Support
#65

The idea that scam plugins have tags like [NEW] and [UPDATED] is pretty far fetched most scam plugins steal a big plugins code and then re upload it, it tricks people into thinking it’s the same plugin. Yeah a few scam plugins have tags like that but you don’t see many with that anymore.

3 Likes
#66

True. Sorry. Although, there’s still a plenty of plugins with mentioned tags. Most of stolen plugins are on the bestselling page of library. Make sure to always look for scams. Those are usually uploaded mutliple times by fake devs, so if you see same plugin multiple times - that’s most likely a scam. Another trait of scam plugins is that they are uploaded by people/groups with similar names all the time; some examples would be: “Plugin Developers”, “Plugin Makers”, “TrustedPlugins”, “[DeveloperX]”, “FrontPlugins”, “Creator Studio”, etc.

So, I think it’s really easy to find a scam plugin. I never really had issues with downloading such. I have no idea why people keep getting “catfished”. Why do they??

#67

I heard of rosync before I want to look up for the company that provides backdoors to be honest

1 Like
#69

Here are the GitHubs that are the source of the malicous code :wink:

#70

Also someone told me this was an important part of the script http://45.79.27.137:8080/roblox DO NOT CLICK

#71

Why what if I click it? Is it an ip grabber?

1 Like
#72

This isn’t malicious code. It’s a Lua bytecode interpreter.

2 Likes
#73

I believe it is a webhook for the malicous Discord sever but I am not really sure. I would not click just to be safe :slight_smile:

#74

Nevermind it redirects this info to the webhook
idRmWkr

#76

Yeah, there behind a lot of these exploits on Roblox there pretty big.

1 Like
#77

I looked up .source = in BTR and no findings other than:

Image
Image1638×923 97.1 KB

#78

Yeah I think it was just a coincidence

#79

Recently I just got these inside of my game.

#80

Nice job! I joined and posted a warning on the group wall. I also reported the group and all there plugins

1 Like
#81

Do you know the webhook address? One could hack it and bring it down, just saying

#82

Not asking for it, just asking if you know it

#83

Not at the moment I believe this has something to do with it http://45.79.27.137:8080/roblox

#84

Heads up: maybe DONT click that link, could be something malicious, you never know.

1 Like
#85

I clicked it without reading lol, nothing malicious it seems

#86

RoSync is a backdoor that appears from malicious and usually fake plugins. RoSync can also be found in free models.

The backdoor seems to load a serverside mainmodule. However I personally do not think RoSync is a threat anymore since there is no proof that it is alive anymore. But because we can not be sure of this, it is recommended to remove the infection and plugin causing it.

RoSync can be removed with GameGuard Antivirus made by @deluc_t. (GameGuard Antivirus)

3 Likes