Blacklist Rules & Enforcement

A WASP blacklist entry is an internal community-security and access-control determination. It is not a criminal conviction, civil judgment, or governmental finding. Entries must be tied to a listed rule and supported by sufficient evidence.

1. Purpose, Scope, and Enforcement Standard

These Blacklist Rules define the conduct that may qualify a user, group, server, or other subject for a WASP blacklist action. The rules are intended to create consistent, evidence-based network enforcement and to prevent ad hoc blacklist reasons that are not part of an approved policy.

A report should identify the applicable rule, the subject being reported, and evidence sufficient to establish a reasonable connection between the subject and the alleged conduct. WASP staff may reject reports that are outside scope, unsupported, materially incomplete, manipulated, or not reasonably attributable to the reported subject.

No ad hoc blacklist reasons. If conduct does not fit an active rule below, staff should not create a new blacklist basis inside an individual case. A new category should first be added to the policy through the normal policy-update process.

1.1 Evidence standards

• Evidence should be authentic, relevant, and sufficiently contextualized to show what occurred and who was responsible.
• Screenshots or clips should include enough surrounding context to avoid materially changing the meaning of the evidence.
• Edited or redacted evidence must not conceal information that would materially alter the case. Necessary redactions should be disclosed.
• Identity linkage should be reasonably established before an action is issued against a Discord, Roblox, or other platform account.
• Hearsay, rumors, or uncorroborated accusations alone are generally insufficient for a network blacklist.
• Knowingly fabricated or materially false evidence may itself qualify under §2.2.2.

1.2 Penalty key

Where multiple proven rules apply, the most serious active penalty controls unless staff records a different outcome in the case decision.

§2.1 Asset Theft, Leaking, and Unauthorized Distribution

These rules apply to unauthorized acquisition, disclosure, distribution, sale, trade, or misuse of digital assets, including Roblox models, scripts, systems, builds, textures, audio, source files, or other protected development materials.

• §2.1.1 Leaking Assets — PERMANENT: Intentionally publishing, disclosing, or distributing protected assets without authorization from the owner or authorized rights holder.
• §2.1.2 Redistribution of Assets — 30 DAYS: Redistributing protected assets outside the scope of the permission or license under which they were obtained.
• §2.1.3 Possession of Leaked Assets — PERMANENT: Knowingly retaining leaked or stolen assets where circumstances establish awareness they were obtained or distributed without authorization.
• §2.1.4 Using Leaked Assets — PERMANENT: Knowingly placing, deploying, developing from, or otherwise using leaked or stolen assets.
• §2.1.5 Selling Leaked Assets — PERMANENT: Offering leaked assets for payment, subscription, trade value, or other consideration.
• §2.1.6 Selling Stolen Assets — PERMANENT: Selling assets obtained through theft, compromise, unauthorized copying, or other unlawful acquisition.
• §2.1.7 Unauthorized Asset Trading — PERMANENT: Trading protected or leaked assets without authorization from the applicable owner or rights holder.
• §2.1.8 Claiming Another Person's Assets as Your Own — PERMANENT: Knowingly representing another creator's protected work as your own or falsely asserting ownership.
• §2.1.9 Asset Theft — PERMANENT: Taking or copying protected assets without authorization, including through compromised access or misuse of privileged access.
• §2.1.10 Conspiracy to Leak Assets — 30 DAYS: Knowingly coordinating, planning, or materially assisting a future leak of protected assets.
• §2.1.11 Attempted Asset Leak — PERMANENT: Taking substantial steps to leak protected assets even when the leak is interrupted or unsuccessful.
• §2.1.12 Soliciting Leaked Assets — PERMANENT: Knowingly requesting, commissioning, or seeking access to leaked or stolen assets.
• §2.1.13 Selling Free/Public Models as Proprietary Assets — PERMANENT: Knowingly reselling free or public assets as proprietary where doing so materially misrepresents ownership or licensing status.

§2.2 Fraud and Deceptive Conduct

• §2.2.1 Scamming — PERMANENT: Knowingly using deception to obtain money, assets, services, credentials, or other value from another person or organization.
• §2.2.2 Justifying a Case with False Evidence — 30 DAYS: Knowingly submitting fabricated, forged, manipulated, or materially misleading evidence to cause or defend a WASP enforcement action.
• §2.2.3 Fraudulent Chargeback Abuse — PERMANENT: Using a payment dispute or chargeback dishonestly to retain goods, services, or assets while reversing payment. Legitimate good-faith consumer disputes are not covered.

§2.4 Doxxing, Credential Theft, and Cyber Attacks

• §2.4.1 Doxxing — PERMANENT: Publishing, threatening to publish, or distributing another person's non-public identifying information without authorization for malicious purposes.
• §2.4.2 Cookie / Token Logging — PERMANENT: Stealing or attempting to capture session cookies, authentication tokens, credentials, or equivalent account-access material without authorization.
• §2.4.3 IP Address Leaking — PERMANENT: Maliciously disclosing another person's non-public IP address without authorization.
• §2.4.4 Address Leaking — PERMANENT: Maliciously disclosing another person's non-public residential or physical address without authorization.
• §2.4.5 Account Theft — PERMANENT: Taking control of, accessing, or transferring another person's account without authorization.
• §2.4.6 Cyber Attacking — PERMANENT: Conducting or materially assisting malicious technical attacks against an account, server, service, website, bot, API, or other system.
• §2.4.7 Conspiracy to Dox — PERMANENT: Knowingly coordinating, planning, or materially assisting a doxxing operation.
• §2.4.8 Attempted IP Logging — PERMANENT: Taking substantial steps to capture another person's IP address through deceptive, malicious, or unauthorized means.

§2.5 Raiding, Nuking, and Administrative Abuse

• §2.5.1 Nuking / Raiding / Administrative Abuse (AA) — PERMANENT: Intentionally disrupting or destroying a server or community through mass deletion, destructive permission changes, unauthorized bans/kicks, spam, malicious automation, or comparable abuse of administrative access.
• §2.5.2 Conspiracy to Nuke, Raid, or Administratively Abuse a Server — 30 DAYS: Knowingly planning, coordinating, recruiting for, or materially assisting a future raid, nuke, or destructive administrative-abuse event.

Attempt vs. preparation. An "attempt" requires conduct beyond discussion alone and should reflect a substantial step toward completing the prohibited act.

§2.6 Direct Association with Prohibited Activity

"Direct association" means knowing and material participation, assistance, facilitation, concealment, coordination, or operational support for the listed misconduct. Mere friendship, server membership, social contact, or presence in the same community does not by itself establish direct association.

• §2.6.1 Direct Association with Asset Leakers — PERMANENT
• §2.6.2 Direct Association with Doxxers — PERMANENT
• §2.6.3 Direct Association with Scammers — PERMANENT

§2.7 Advertising High-Risk Servers

• §2.7.1 Advertising a Scamming Server — 30 DAYS
• §2.7.2 Advertising a Leaking Server — 30 DAYS
• §2.7.3 Advertising a Doxxing Server — 30 DAYS

§2.8 Enhanced Interaction with Blacklisted Servers

• §2.8.1 Enhanced Interaction with Blacklisted Servers — 30 DAYS: Knowingly providing material operational support, staffing, management, promotion, or technical assistance to a server blacklisted for serious prohibited activity. Incidental membership alone is not sufficient.

§2.9 Other Active Rules

• §2.9.1 Neo-Nazi Promotion or Targeted Extremist Harassment — 30 DAYS: Knowingly promoting neo-Nazi propaganda or using neo-Nazi symbols/ideology as part of targeted harassment, intimidation, recruitment, or harmful community activity. Conduct-based; not applied solely from an unsupported label.
• §2.9.4 Impersonating WASP Staff — 14 DAYS: Knowingly representing yourself as WASP staff, an authorized investigator, reviewer, administrator, or official representative when not authorized.

5. Case Decisions, Appeals, and Record Status

• The case must identify at least one active rule that supports the action.
• The case record should summarize the conduct, the subject identity, the key evidence, and the applicable penalty.
• A blacklist should not be issued solely because a user is disliked, controversial, socially associated, or accused without adequate support.
• Network-wide actions should be approved only by staff authorized to issue WASP-wide enforcement.

A blacklisted subject may submit an appeal through the current WASP appeal process. Filing an appeal does not itself invalidate the existing action while review is pending.

5.3 Appeal status labels

Integrity of the blacklist. The purpose of the blacklist is to identify documented security and trust risks, not to serve as a public punishment board. Staff should apply these rules consistently, document decisions, and avoid exaggerating what a blacklist entry means.