PSA: Several servers are being DDoS attacked by a botnet.

[Kyuande]

Been hosting for a while with nfo and I haven't got down yet but have been hit hard in a way with event logs - but no loss of anything.

So I'm just going to dump the IPs:

2.50.152.161 - Unknown

If anyone can find these that would be great, but NFO has been spamming me with the first IP and got console spam with the 2nd IP.

[Ad Bot]

[Val]

could a possible remedy be to password the server? i remember testing once connection spam attempts to lag servers, and passwording stopped it entirely. dont really kno that much about networking so pls educate me

There's a lot less that goes on if the server password check doesn't pass, but that's assuming the attacker is using crafted packets that match the game joining process.

And to even get to that state they have to respond to a special message sent to them in the first place, so it's not like they can copy paste a Wireshark's session of data either... maybe if they copied from a session per-ip since it's based on the connecting ip, but that's a lot of work for tons of ips.

[Metario]

Been hosting for a while with nfo and I haven't got down yet but have been hit hard in a way with event logs - but no loss of anything.

So I'm just going to dump the IPs:
63.251.20.251 - New York, US
2.50.152.161 - Unknown

If anyone can find these that would be great, but NFO has been spamming me with the first IP and got console spam with the 2nd IP.

ruhroh!
first IP is a NFO ip!!

[Kyuande]

I just realized that's my NFO server so it seems that it somehow managed to attack itself, not sure how or why but it stopped after a while. The 2nd IP I have no idea where that's even from or who it could be.

If it gets bad I'll just move the server.


Seems like the attacks have stopped, hopefully they do because whoever is doing it is just wasting their time

[TheBlackParrot]

keep trying, you're not going to get far


this is probably a botnet, all the locations are random

that first one, in fact, is from Eastern Michigan University

[PhantOS]

its either brozie or jiggy calling it rn

[Mega-Bear]

honestly forget michigan

[Conan]

honestly forget michigan

honestly forget internet

[FireFlame2]

brickman is ddosing blockland

[TheBlackParrot]

[Cadlage]

bot goes by the other alias dark sorrow
confirmed ddoser

[Refticus]

is there anything we can do at all?
if they have hundreds of random ips, then blocking their attacks through ips isn't going to help.

do we just wait for them to get bored?

[TheBlackParrot]

do we just wait for them to get bored?

unfortunately that's pretty much all we can do

[Refticus]

unfortunately that's pretty much all we can do

that's real forgetin great as i finally got around to hosting a blockparty, only for a ddos attack to appear out of nowhere

[TheBlackParrot]

viso's getting hit again, i'm not being hit yet