[ENDED] VC:MP down due to DDoS attack

[stormeus]

The server has been taken offline by the service provider due to a significant DDoS attack against it. Downtime will be at least three hours long.

As a precautionary measure, we have temporarily disabled network traffic to your droplet to protect our network and other customers. Once the attack subsides, networking will be automatically reestablished to your droplet. The networking restriction is in place for three hours and then removed.

Please note that we take this measure only as a last resort when other filtering, routing, and network configuration changes have not been effective in routing around the DDoS attack.

I'll post updates as more information becomes available. In the meantime, this thread will be locked to restrict posting to updates regarding the situation.

[stormeus]

Beginning at 6:52pm GMT, the server was hit by a DDoS attack, peaking at about 1000Mb/s before all traffic to and from the server was disabled by the hosting provider. The networking restriction will be lifted around 9:52pm and further monitored from then.

Should the attack continue after that time, an alternate server will be brought up in Frankfurt, Germany. This server will be restored from a backup that was made on March 18 at 4:29am GMT; any transactions after that will not be available on the backup server, and any transactions made on the backup server will not be carried over to the main server when it's back up.

[stormeus]

The server is back online. Hourly backups are currently being set up in case the server is brought offline again.

[Marcell]

So could this type of attack be made by some raging banned player in his mother's basement or would it require something more sophisticated? I'm suprised how easily the server went down compared to the old 2.0 scripts

[stormeus]

I highly doubt some random raging player would be able to launch a gigabit/second attack. The attack was substantial enough for the hosting provider to have to step in and mitigate it.

[Marcell]

Could it be a random raging player with access to many zombie PCs and some basic knowledge then? I'm really curious about this because it's not like a gaming community server with 10-20 players average would be the target of someone more sophisticated. If not a raging player, how about owners of one of the servers that treat us as competition?.. (won't spread any more detailed accusations here)

[Agent002]

[blank]

[stormeus]

Could it be a random raging player with access to many zombie PCs and some basic knowledge then? I'm really curious about this because it's not like a gaming community server with 10-20 players average would be the target of someone more sophisticated.

If someone wanted to pay for a botnet to launch a DDoS attack, they could, but it'd be something like $35-38/hr, which is still a lot of money to take down this one server for a couple of hours.

If you can check the attacker's IP and match it with every IP the players have been banned, it'll be wonderful.

I don't have information about the source at this time. Flood logging wasn't enabled on the server itself when it was taken down, and the host mitigated the attack by simply not routing traffic to the server for the duration of it, so they don't have any means of logging connections to a disconnected server.

[Klaus]

I'm glad the downtime was short lived.

Haters gonna' hate.

[Kessu]

Don't spread false accusations or create rumours as to who is behind the attack.

Glad it's over quickly tho'.