I think I have e-enemies

[MrPresident]

Recently I've decided to close down |G4P| indefinitely. One day a few months ago we started getting DDoS attacks off and on. I didn't think too much of it at the time as it had happened before. I was running a fairly successful and popular death match server for Garry's Mod and we banned multiple people for cheating every day. I figured I butt hurt some little kid or something.

I attempted to block the IPs associated with the attack, to which the attack seemed to stop. A few days later it came back, with more force than before. It was so bad that I couldn't even remote into my server to do anything about it. I had to contact the customer support of my hosts and have them nullroute the IP, luckily I had 4 more at my disposal. I changed IP on my server which set us back as far as playerbase who found us regularly through their favorites/history for a few days but things were looking back to normal when the attack started up again.

At this point they were hitting us with a 100 mbit/s botnet... All I could think of was "What the !!" Granted this was roughly 2 weeks after the attacks had started and they were on and off every day up until this point. I was about to go on a 9 day long training event so I just shut down the server and turned everything off for the duration.

When I came back I waited a few days to get everything in order and I decided to start up the server again (with a NEW IP address). I figured it's been over 30 days since the start of the attacks... they couldn't possibly still have interest... Boy was I ever so wrong... The server was up for about 24 hours when it started getting hit even harder this time.


This is a capture of the bandwidth meter from my host. 15 straight hours of maxing out our network card... I don't remember how much bandwidth it had used before I caught it.. The picture says 592GB down (which was thankfully unmetered...) and 114GB up which is what we get charged for. I'm not sure how a botnet could be causing upload but it was.




I just don't have the time to deal with the immaturity anymore.. not to mention that I was paying $120 a month for the server and we were losing all of our player base and therefor donations because of it.

I will be dedicating my time to getting back into developing and just enjoying my time online as opposed to babysitting a server and a community. Hopefully that means you'll be seeing me around here a lot more and maybe I'll find the time to revamp all of my old ULib projects and make them more compatible with the new ULX release.

Just thought I'd share my story.. cheers!

[JamminR]

Wow.
Shame really.
Though you changed IPs, did you ever change server host names? For instance, have you always used <some_static_name>.g4p.org:<some port> for each server?
That would explain the '24 hour' delay after starting each time. DNS records can take that long to go from your host across the interwebs.
Also, ever consider asking your host to look into dropping the specific attack vector at thier gateway? Surely it was affecting other customers on your cards node.
Anyway, sorry to hear.
We're glad you'll be visiting more, and look forward to it.

[MrPresident]

We tried using an IP that wasn't tied in to the g4p domain. It still got attacked. At this point, I really just don't care anymore. I'm kind of glad to be done with it to be honest. I wasn't really enjoying running the servers as much as I did coding the gamemodes and mods before.

[Megiddo]

Hmm, too bad. Your host wasn't willing to help you out with blocking the attacking IPs?

[MrPresident]

Unfortunately they said they were an unmanaged host and therefore couldn't really do anything about it other than nullroute the whole IP.

[JamminR]

Pres, have you thoroughly researched to make sure your server wasn't exploited and has now become a mass file or p2p server?
Tried running the server from a diff box/re-imaged box?
I would presume so, but, just making sure. Upload being 1/5th download seems bit off, even for a DDoS "load webpage as many times as possible using botnet" attack.
Looking at my routers last month and this month usage, seems my upload is about usually half my total download.

[MrPresident]

Yeah, during the attacks I would run wireshark to see where the attack was coming from and all of the incoming requests were UDP connections on the IP and Port of the GMod server. Stopping the GMod server would effectively stop the attack.

[JamminR]

Ok. I figured you had, but was just wanting to throw it out there.
So have you totally taken down g4p.org now? Do you own v3guild and is it too down?
I'm unable to reach both.
Doing some research on the net to see if I could find any discussion as to who might be some ring leaders attacking you. Came across v3guild mentioning the attack, but can't reach it.
www.g4p.org is unreachable for me too.

[MrPresident]

Yeah, v3guild was a domain I had a while back that also pointed to the same IP as g4p.org. Neither domain is available anymore as I removed the IP from the server associated with both of them and I don't plan on resolving them again in case the attack WAS targeting the domain name.