[Phaze]

Pictures first:
First


Then


Finally


Now my explanation..
So, I was told that this afternoon about 3PM EST that someone came in and started doing this (pictures show the actions).. The IP comes from Russia and we had about 50+ players on.
It banned all the players and we had to clear samp.ban..
So, I don't know if this is a new SA:MP exploit or something on my side; I've never had this problem before..

Thanks...

[Lynn]

Have any developers been fired recently?
Possibly have a backdoor in the script.
Maybe someone else has a better explanation.

[Phaze]

Quote:

Originally Posted by Lynn Have any developers been fired recently? Possibly have a backdoor in the script. Maybe someone else has a better explanation.

There's only one developer in my community and has access to everything. I've known him for nearly 2 years and I'm sure he wouldn't do anything to harm the community.

Sounds too good to be true backdoor. We have NPC disabled and we're running 0.3x R2 server

[cessil]

sounds like a bug in your script

[Lynn]

Is your Rcon password complex?
What Filterscripts, if any are loaded?

[Phaze]

Quote:

Originally Posted by Lynn Is your Rcon password complex? What Filterscripts, if any are loaded?

Ym1aCi7WAuq4d0t - My RCON pass is similar to that, although my RCON is set to 0 in my config.. I don't know if that would deal with anything..


Mapping filterscripts, y_buttons and removebuilding.. All of them have been checked and do not seem to have any suspicious coding..

Quote:

Originally Posted by cessil sounds like a bug in your script

What do you think the bug would relate to? OnPlayerConnect?

[cessil]

possibly something to do with flooders, you have that unban text, see why they're getting unbanned

[Mark™]

That's a bot attack from a single IP address. Use MAXIPS Filterscript provided by sa-mp team and prohibit multiple connections.

[MrLazyAss]

I got the same thing for my server but in my server_log it had 1,000 lines a second for 30 minutes with packet modified ??