What is a DDoS attack?
How these attacks work, how we keep them out, and every figure we record about the traffic that reaches us, live.
A flood, not a break-in
A DDoS does not hack anything. It buries the server in junk traffic so real players cannot get through.
Nothing is lost
Your character, cars, money and items are saved on the server. An attack can knock you off, but it cannot touch your progress.
Minutes, not hours
Our network is watched around the clock, and we work directly with X4B, a DDoS protection network built for game servers. Attacks are spotted as they start and filtered out.
It is a crime
Launching or paying for a DDoS is a criminal offence in the UK, across the EU and in most of the world. We report every attack to the police.
Network defence
Counted every minute on our own network. We never publish addresses, ports or filter settings.
Monitoring
Traffic is normal. Our defences are on and the network is watched around the clock.
Incoming traffic, last hour
Packets a second, each minuteSpikes, last 24 hours
Peak in each 15 minutesData received, per day
Junk blocked, per day
Attack record
Every attack and probe we have recorded. Each links to its incident report when one was opened.| When | Type | Length | Peak | Blocked | Disconnects | Report |
|---|---|---|---|---|---|---|
What a DDoS actually is.
DDoS stands for distributed denial of service. Strip away the jargon and it is a traffic jam, made on purpose.
Imagine the only road into the city. Normally it carries a steady stream of cars: that is you and everyone else playing. A DDoS is someone sending thousands of empty lorries down that road at once. Nothing is wrong with the city itself, but nobody real can get in.
In computer terms, everything you do in game is sent to the server as tiny messages called packets. The server reads them one by one. Flood it with millions of fake packets and it spends all its time reading junk. Your real packets wait in the queue, and after a few seconds your game gives up.
Denial of service means stopping a service from working. Distributed means the traffic comes from lots of places at once, which is what makes it so much harder to stop than one person on one connection.
The three ways to drown a server.
Almost every DDoS is one of these, or a mix. They differ in what they try to run out of: the connection, the machine, or the software.
Fill the pipe
Send more data than the connection can carry, like blocking a road with enormous lorries. Measured in bits per second. The biggest attacks on record run to several terabits a second, far more than any single server’s connection.
Exhaust the machine
Send huge numbers of tiny packets. Each one is light, but the server must stop and look at every single one. Measured in packets per second. This is the kind we see most, and the kind that hit us on 20 October.
Look like a real visitor
Send requests that look like real players or real web visitors, so they are hard to tell apart and each one costs the server real work. Measured in requests per second. These are aimed at websites more than game servers.
The tricks behind an attack.
Attackers rarely use their own connection. They borrow other people’s, lie about where traffic comes from, and get innocent servers to do the heavy lifting.
- 01
Botnets
Ordinary home computers, routers, cameras and phones around the world, infected with malware and remote-controlled, almost always without their owners knowing. Each sends a little traffic; tens of thousands together make a wall. Attackers rent them by the hour.
- 02
Spoofed addresses
Every packet carries a return address, like the back of an envelope, and nothing on the internet checks it is true. Attackers write made-up ones, so one machine can look like a hundred thousand senders and blocking addresses stops working.
- 03
Reflection
The attacker sends a small question to someone else’s server, with your address written as the sender. The answer, often much bigger, lands on you. Thousands of innocent servers end up attacking a target they have never heard of.
- 04
Switching targets
Attacks rarely sit still. They hop between servers and come back in waves, testing whether the defences are the same everywhere and making the attack harder to pin down.
Why game servers are a favourite target.
A website can make you wait half a second and you would never notice. A game cannot.
A game is a conversation in real time. Your game and the server swap small messages many times a second, and if they stop hearing each other for a few seconds, the game gives up and disconnects you. That makes a game far easier to disrupt than a website.
A game server has one part whose only job is reading incoming traffic. Think of it as the post room. Your movements, your car and your chat all arrive there first. In an attack, the post room is buried in junk letters. The rest of the server, the part that runs the world, carries on perfectly well; it just stops receiving your messages.
That is also why an attack never costs you progress. Nothing is broken and nothing is lost. The road in is blocked, and as soon as it clears you drive straight back in.
Six layers, from the outside in.
No single defence stops every attack. Each layer catches what the one before it lets through, and the Phytoventures team behind Plexa watches all of them, around the clock, working directly with X4B.
X4B, our protection network
We work directly with X4B, a DDoS protection network built for game servers. All game traffic reaches us through X4B, so big floods are spotted and filtered far out on the internet, before they ever reach our servers.
Speed limits and a block list
Every sender has a sensible speed limit, far above anything a real player needs. Traffic that attackers like to bounce off other people’s servers is refused, and machines caught attacking us go on a permanent block list.
Only real players get in
Before your game sends any game traffic, it makes a normal web connection first. A fake address cannot complete that step. So we keep a list of players who connected properly, and everything else is thrown away at the door before the game server sees it.
Nothing open that does not need to be
When someone tries one door, you check all of them. Internal services are closed to the internet entirely, so there is nothing else for an attacker to lean on.
Watched every minute
Traffic, server health and player connections are measured every minute. Our network security team is alerted the moment something looks wrong, day or night, with which server is targeted and whether players are affected.
Every attack makes the next one harder
Each incident is studied afterwards: what it looked like, what got through, and what we can build so it does not get through next time. The front-door check on this page exists because of one attack.
Did it work?
Two hours after the main attack on 20 October, someone tried again. A single machine started firing about a thousand packets a second at the English server. It had never played and never connected properly.
The front door turned away about 128,000 of its packets in two minutes. The players online saw nothing: no lag, no timeouts. The alarm went off in our security channel while it was happening, and the sender went straight onto the block list.
We do not see an attack as a defeat. Every attempt shows us what attackers are trying and how their traffic looks, and every attempt makes the next one harder.
- Done
Protection further up the road
We now work directly with X4B. Game traffic comes in through their network, built for game servers, so junk is filtered out long before it reaches us.
- Done
Separate roads
The websites and the game servers now have separate routes in, so an attack on one cannot slow the other down.
- Next
An even faster front door
Moving the filter to the very first point where traffic enters the server, so throwing junk away costs almost nothing.
What you will see, and what to do.
If you are ever knocked off along with everyone else, this is what is going on and how you can help.
- 01
Everyone freezes
The world stops moving, a timer starts counting, and after a few seconds your game says the connection timed out. Everyone on the server sees the same thing at the same moment.
- 02
Wait a minute, then rejoin
Most attacks are filtered within a minute or two. Rejoining straight away usually works. Your character is exactly where the server last saved them.
- 03
Check what is going on
This page shows live traffic and whether an attack is in progress. The connection check tells you if anything is blocking you personally.
- 04
Tell us the time
If you were knocked off, open a ticket with the time it happened and your time zone. We line it up with our traffic records and tell you exactly what was going on.
A DDoS is a crime. It is never worth it.
Some people treat DDoS attacks as a prank or part of gaming culture. The courts do not.
- In the UK stopping a computer system from working properly is an offence under the Computer Misuse Act 1990, with a maximum sentence of 10 years in prison.
- Across the EU including the countries our Balkan community lives in, deliberately disrupting a computer system is a criminal offence under national laws based on the EU directive on attacks against information systems. The US and most other countries have similar laws.
- Paying for one counts sites that sell attacks call themselves stressers or booters and claim to be for testing your own server. Using one on someone else’s server is still an attack, and buying it makes you part of it.
- It is not anonymous police forces around the world, including the UK’s National Crime Agency, take down attack-for-hire sites and seize their customer lists. Under an international operation called PowerOFF, dozens have been shut down and their users warned, arrested and charged. Some of those sites were run by the police all along.
A few minutes of people being disconnected from a game, in exchange for a criminal record, a seized computer and a permanent ban from the communities you were part of. If you have a problem with us, open a ticket. We would much rather talk.
Every attack is reported
We report every attack on our network to the UK authorities and send them our forensic evidence: traffic captures, timings and the records our systems keep. We are in regular contact with:
Know something about an attack on us? Tell us through support, or report it to Report Fraud yourself.
Frequently asked.
The questions players ask us most after an attack.
Can a DDoS steal my account or my data?
No. A DDoS floods a server with traffic; it does not break into anything. Accounts, passwords and characters are not exposed by it. It is a traffic jam, not a burglary.
Will I lose progress if I am knocked off?
No. The game server keeps running during an attack and saves as normal. You are disconnected because your game cannot hear the server for a few seconds, not because anything broke.
Why not just block the attacker?
There usually is no single attacker to block. The traffic comes from thousands of infected devices, or from made-up addresses that belong to nobody. That is why we check that a player is real instead of chasing who is fake.
Is it another player doing this?
We do not guess, and we will not point fingers without evidence. The attack traffic we have seen came from infected machines and fake addresses, none of which had ever played on our servers. Anyone can rent that.
Why not put the game servers behind Cloudflare like the websites?
Cloudflare’s standard protection is built for websites, and our websites do sit behind it. Game traffic works differently and needs a network built for it, so our game servers sit behind X4B, a protection network made for game servers that we work with directly. It filters attacks far out on the internet before they reach us.
How do you know it is an attack and not just a busy evening?
A busy evening is a few hundred extra players. An attack is hundreds of times more traffic than normal arriving in seconds, mostly from senders that never connected properly. We measure every minute, so the difference is obvious.
Do you publish the addresses of attackers?
No. We never publish addresses, ports or our filter settings, on this page or anywhere else. Every attack is reported to the police, with our forensic evidence, and to the networks the traffic came from.
What do the figures on this page count?
Data received is everything that reached our game servers and sites, real and junk together. Packets blocked are junk our filters threw away before they reached a server. An attack is a large flood; a probe is a smaller burst, usually someone testing whether our defences are still up.
The words, explained.
- Packet
- A small parcel of data. Everything you do in game, walking, driving or talking, travels as packets.
- Packets a second
- How many packets arrive each second. A normal night for us is a few hundred to a few thousand; the biggest attack we have recorded is in the live figures above.
- Bandwidth
- How much data a connection can carry each second, usually in megabits or gigabits.
- Botnet
- A network of infected devices, controlled remotely and rented out to send attack traffic.
- Spoofing
- Writing a fake return address on a packet so it cannot be traced or blocked by address.
- Reflection
- Bouncing traffic off someone else’s server so the replies land on the target.
- Amplification
- Reflection where the reply is many times bigger than the question, multiplying the attack.
- Scrubbing
- Filtering attack traffic out on a large network before the clean traffic is passed on to the target.
- Probe
- A small burst of traffic used to test whether a target’s defences are up, often before a bigger attack.
Knocked off, or can’t get back in?
Check whether anything is blocking you, see the live state of every service, or tell us what happened and when.