[1shot]

fuck, mi server are attacked by ddos i use windows, this attack down my conection to internet
[02:23:04] Incomming connection: 190.254.123.3:14499
[02:23:05] Incomming connection: 190.254.123.3:14502
[02:23:06] Incomming connection: 83.21.193.7:2087
[02:23:06] Incomming connection: 189.191.95.54:3008
[02:23:06] Incomming connection: 189.144.89.216:59246
[02:23:06] Incomming connection: 190.78.177.158:3362
[02:23:06] Incomming connection: 189.144.89.216:59247
[02:23:06] Incomming connection: 190.78.177.158:3363
[02:23:06] Incomming connection: 189.144.89.216:59248
[02:23:06] Incomming connection: 190.158.12.159:2704
[02:23:06] Incomming connection: 88.19.111.235:23729
[02:23:06] Incomming connection: 189.144.89.216:59249
[02:23:06] Incomming connection: 190.78.177.158:3364
[02:23:06] Incomming connection: 190.131.2.105:58979
[02:23:06] Incomming connection: 189.141.173.191:61279
[02:23:06] Incomming connection: 190.233.94.160:29915
[02:23:06] Incomming connection: 190.158.12.159:2705
[02:23:06] Incomming connection: 88.19.111.235:23730
[02:23:06] Incomming connection: 190.78.177.158:3365
[02:23:06] Incomming connection: 189.144.89.216:59250
[02:23:06] Incomming connection: 190.158.12.159:2706
[02:23:06] Incomming connection: 189.191.95.54:3009
[02:23:06] Incomming connection: 190.232.134.57:13639
[02:23:06] Incomming connection: 190.46.154.140:4201
[02:23:06] Incomming connection: 189.141.173.191:61281
[02:23:06] Incomming connection: 190.78.177.158:3366
[02:23:06] Incomming connection: 201.232.8.63:55746
[02:23:06] Incomming connection: 200.105.189.3:2793
[02:23:06] Incomming connection: 88.19.111.235:23731
[02:23:06] Incomming connection: 201.137.205.167:2085
[02:23:06] Incomming connection: 201.137.205.167:2084
[02:23:06] Incomming connection: 189.188.133.163:2100
[02:26:07] Detected possible bot from (83.63.231.186)
[02:28:37] Detected possible bot from (189.188.176.93)
[02:33:29] Incomming connection: 190.41.5.234:28173
[02:34:20] Incomming connection: 88.19.111.235:26869
[02:36:01] Detected possible bot from (79.156.131.72)
its posible stop the attack?

[Leethan]

Temporarily ban those ranges

[BP13]

happened to me too. I went from 60 players to 0

[1shot]

Quote:

Originally Posted by MuL1pl3x Temporarily ban those ranges

Too many ips to ban, my router no found why the attack i change new ip to found the router :S

[BP13]

Check this out its my support tick to ServerHEX. Are you having the same thing?

Quote:

t0m93 20:19:38 30/07/09 Hello. Regards to my last post about the inadvisable bot attack it might be related to something. My server just randomly went offline and the auto restarter just sat there and did nothing. Now boylett let me make my self more clear on the invisible bot attack situation. I was going to join the server and it had 60/100 players. When I tried to join it says Server full retrying... So I restarted the server. And nothing changed. So I reinstalled the game server. turned it one and it said Server full retrying even though there was no one in there. And nobody else could connect. after awhile some people got in all the way up until we got 60 players. but the id's of the players ranged from 0-99 while skipping some ID's. these ID's were filled up what I was to believe was a "bot slot" when there was more than 60 people it would just say the server is full again. all the way until the game server needed to be re-installed again. yet filling up again from id 0-99 with 60 players. Also on the server log after the restart no one joined but the slots were filled up somehow. Seems it was doing good after 12PM (EST) today. That is when I believe the attackers have stopped. Boylett 23:02:34 30/07/09 It seems to be a new server exploit.

[Leethan]

Quote:

Originally Posted by 1shot Quote: Originally Posted by MuL1pl3x Temporarily ban those ranges Too many ips to ban, my router no found why the attack i change new ip to found the router :S

I said the ranges if its that difficult i can get the 4-5 ranges for you -.-

190
83
189
190
99
201
200
79

[1shot]

Quote:

Originally Posted by [SU BP13 ] Check this out its my support tick to ServerHEX. Are you having the same thing? Quote: t0m93 20:19:38 30/07/09 Hello. Regards to my last post about the inadvisable bot attack it might be related to something. My server just randomly went offline and the auto restarter just sat there and did nothing. Now boylett let me make my self more clear on the invisible bot attack situation. I was going to join the server and it had 60/100 players. When I tried to join it says Server full retrying... So I restarted the server. And nothing changed. So I reinstalled the game server. turned it one and it said Server full retrying even though there was no one in there. And nobody else could connect. after awhile some people got in all the way up until we got 60 players. but the id's of the players ranged from 0-99 while skipping some ID's. these ID's were filled up what I was to believe was a "bot slot" when there was more than 60 people it would just say the server is full again. all the way until the game server needed to be re-installed again. yet filling up again from id 0-99 with 60 players. Also on the server log after the restart no one joined but the slots were filled up somehow. Seems it was doing good after 12PM (EST) today. That is when I believe the attackers have stopped. Boylett 23:02:34 30/07/09 It seems to be a new server exploit.

No this down my conex why internet by the server, my internet no found all people in my server exit.

I ban the range by (190.0.0.0), and minutes latters of the firts attack
[02:43:59] Detected possible bot from (190.246.181.85)
[02:43:59] Incomming connection: 189.208.196.133:4953
[02:43:59] Incomming connection: 201.228.40.198:18016
[02:43:59] Incomming connection: 190.220.12.218:4115
[02:43:59] Incomming connection: 200.78.241.212:44379
[02:44:01] Detected possible bot from (80.39.4.49)
[02:44:09] Detected possible bot from (190.71.201.50)

[RoBo]

It's netzeek's server full attacks, pretty easy to stop by blocking a few IP ranges.

190.0.0.0/8
201.0.0.0/8
200.0.0.0/8
189.0.0.0/8

[.::: Ecko :::.]

Quote:

Originally Posted by RoBo It's netzeek's server full attacks, pretty easy to stop by blocking a few IP ranges. 190.0.0.0/8 201.0.0.0/8 200.0.0.0/8 189.0.0.0/8

How do you know it's 'netzeek' ?
Isn't he stopped hacking sa-mp servers already?!


Ecko

[KingJ]

Quote:

Originally Posted by RoBo It's netzeek's server full attacks, pretty easy to stop by blocking a few IP ranges. 190.0.0.0/8 201.0.0.0/8 200.0.0.0/8 189.0.0.0/8

To block those ranges, first try adding them to samp.ban in the following format;

Code:

189.*.*.*
190.*.*.*
200.*.*.*
201.*.*.*

If your SA-MP server is still suffering, you will need to ban them at the physical server level through the use of a firewall so that the traffic never even reaches the SA-MP server.