What is a DDoS attack?
How these attacks work, how we keep them out, and every figure we record about the traffic that reaches us, live.
A flood, not a break-in
A DDoS does not hack anything. It buries the server in junk traffic so real players cannot get through.
Nothing is lost
Your character, cars, money and items are saved on the server. An attack can knock you off, but it cannot touch your progress.
Minutes, not hours
Our network is watched around the clock, alongside our provider. Attacks are spotted as they start and filtered out.
It is a crime
Launching or paying for a DDoS is a criminal offence in the UK, across the EU and in most of the world.
Network defence
Traffic is normal. Our defences are on and the network is watched around the clock.
What we have handled
Data received, per day
All incoming traffic, UK days
Collecting the first day.
Junk blocked, per day
Packets our filters threw away
Collecting the first day.
Incoming traffic, last hour
Packets arriving every second, minute by minute
Collecting the first samples.
Spikes, last 24 hours
The busiest minute in each 15 minutes
Collecting the first samples.
Attack record
Loading the record.
What a DDoS actually is.
DDoS stands for distributed denial of service. Strip away the jargon and it is a traffic jam, made on purpose.
Imagine the only road into the city. Normally it carries a steady stream of cars: that is you and everyone else playing. A DDoS is someone sending thousands of empty lorries down that road at once. Nothing is wrong with the city itself, but nobody real can get in.
In computer terms, everything you do in game is sent to the server as tiny messages called packets. The server reads them one by one. Flood it with millions of fake packets and it spends all its time reading junk. Your real packets wait in the queue, and after a few seconds your game gives up.
Denial of service means stopping a service from working. Distributed means the traffic comes from lots of places at once, which is what makes it so much harder to stop than one person on one connection.
The three ways to drown a server.
Almost every DDoS is one of these, or a mix. They differ in what they try to run out of: the connection, the machine, or the software.
Fill the pipe
Send more data than the connection can carry, like blocking a road with enormous lorries. Measured in bits per second. The biggest attacks on record run to several terabits a second, far more than any single server's connection.
Exhaust the machine
Send huge numbers of tiny packets. Each one is light, but the server must stop and look at every single one. Measured in packets per second. This is the kind we see most, and the kind that hit us on 20 October.
Look like a real visitor
Send requests that look like real players or real web visitors, so they are hard to tell apart and each one costs the server real work. Measured in requests per second. These are aimed at websites more than game servers.
The tricks behind an attack.
Attackers rarely use their own connection. They borrow other people's, lie about where traffic comes from, and get innocent servers to do the heavy lifting.
- 01
Botnets
Ordinary home computers, routers, cameras and phones around the world, infected with malware and remote-controlled, almost always without their owners knowing. Each sends a little traffic; tens of thousands together make a wall. Attackers rent them by the hour.
- 02
Spoofed addresses
Every packet carries a return address, like the back of an envelope, and nothing on the internet checks it is true. Attackers write made-up ones, so one machine can look like a hundred thousand senders and blocking addresses stops working.
- 03
Reflection
The attacker sends a small question to someone else's server, with your address written as the sender. The answer, often much bigger, lands on you. Thousands of innocent servers end up attacking a target they have never heard of.
- 04
Switching targets
Attacks rarely sit still. They hop between servers and come back in waves, testing whether the defences are the same everywhere and making the attack harder to pin down.
Why game servers are a favourite target.
A website can make you wait half a second and you would never notice. A game cannot.
A game is a conversation in real time. Your game and the server swap small messages many times a second, and if they stop hearing each other for a few seconds, the game gives up and disconnects you. That makes a game far easier to disrupt than a website.
A FiveM server has one part whose only job is reading incoming traffic. Think of it as the post room. Your movements, your car and your chat all arrive there first. In an attack, the post room is buried in junk letters. The rest of the server, the part that runs the city, carries on perfectly well; it just stops receiving your messages.
That is also why an attack never costs you progress. Nothing is broken and nothing is lost. The road in is blocked, and as soon as it clears you drive straight back in.
Six layers, from the outside in.
No single defence stops every attack. Each layer catches what the one before it lets through, and the Phytoventures team behind PlexaRP watches all of them, around the clock, alongside our network provider.
Our network provider
Our provider's systems watch for large attacks heading towards us, flag them, and follow up with the networks the traffic came from. Big floods are spotted before they ever reach our building.
Speed limits and a block list
Every sender has a sensible speed limit, far above anything a real player needs. Traffic that attackers like to bounce off other people's servers is refused, and machines caught attacking us go on a permanent block list.
Only real players get in
Before your game sends any game traffic, it makes a normal web connection first. A fake address cannot complete that step. So we keep a list of players who connected properly, and everything else is thrown away at the door before the game server sees it.
Nothing open that does not need to be
When someone tries one door, you check all of them. Internal services are closed to the internet entirely, so there is nothing else for an attacker to lean on.
Watched every minute
Traffic, server health and player connections are measured every minute. Our network security team is alerted the moment something looks wrong, day or night, with which server is targeted and whether players are affected.
Every attack makes the next one harder
Each incident is studied afterwards: what it looked like, what got through, and what we can build so it does not get through next time. The front-door check on this page exists because of one attack.
Did it work?
Two hours after the main attack on 20 October, someone tried again. A single machine started firing about a thousand packets a second at the English server. It had never played and never connected properly.
The front door turned away about 128,000 of its packets in two minutes. The players online saw nothing: no lag, no timeouts. The alarm went off in our security channel while it was happening, and the sender went straight onto the block list.
We do not see an attack as a defeat. Every attempt shows us what attackers are trying and how their traffic looks, and every attempt makes the next one harder.
Protection further up the road
We are trialling a protected network built for FiveM servers. Players connect through its huge network, and junk is filtered out long before it reaches us.
An even faster front door
Moving the filter to the very first point where traffic enters the server, so throwing junk away costs almost nothing.
Separate roads
Giving the websites and the game servers separate routes in, so an attack on one cannot slow the other down.
What you will see, and what to do.
If you are ever knocked off along with everyone else, this is what is going on and how you can help.
- 01
Everyone freezes
The city stops moving, a timer starts counting, and after a few seconds your game says the connection timed out. Everyone on the server sees the same thing at the same moment.
- 02
Wait a minute, then rejoin
Most attacks are filtered within a minute or two. Rejoining straight away usually works. Your character is exactly where the server last saved them.
- 03
Check what is going on
This page shows live traffic and whether an attack is in progress. The connection check tells you if anything is blocking you personally.
- 04
Tell us the time
If you were knocked off, open a ticket with the time it happened and your time zone. We line it up with our traffic records and tell you exactly what was going on.
A DDoS is a crime. It is never worth it.
Some people treat DDoS attacks as a prank or part of gaming culture. The courts do not.
- In the UK · stopping a computer system from working properly is an offence under the Computer Misuse Act 1990, with a maximum sentence of 10 years in prison.
- Across the EU · including the countries our Balkan community lives in, deliberately disrupting a computer system is a criminal offence under national laws based on the EU directive on attacks against information systems. The US and most other countries have similar laws.
- Paying for one counts · sites that sell attacks call themselves stressers or booters and claim to be for testing your own server. Using one on someone else's server is still an attack, and buying it makes you part of it.
- It is not anonymous · police forces around the world, including the UK's National Crime Agency, take down attack-for-hire sites and seize their customer lists. Under an international operation called PowerOFF, dozens have been shut down and their users warned, arrested and charged. Some of those sites were run by the police all along.
A few minutes of people being disconnected from a game, in exchange for a criminal record, a seized computer and a permanent ban from the communities you were part of. If you have a problem with us, open a ticket. We would much rather talk.
Frequently asked.
The questions players ask us most after an attack.
The words, explained.
- Packet
- A small parcel of data. Everything you do in game, walking, driving or talking, travels as packets.
- Packets a second
- How many packets arrive each second. A normal night for us is a few hundred to a few thousand; the biggest attack we have recorded was over 475,000.
- Bandwidth
- How much data a connection can carry each second, usually in megabits or gigabits.
- Botnet
- A network of infected devices, controlled remotely and rented out to send attack traffic.
- Spoofing
- Writing a fake return address on a packet so it cannot be traced or blocked by address.
- Reflection
- Bouncing traffic off someone else's server so the replies land on the target.
- Amplification
- Reflection where the reply is many times bigger than the question, multiplying the attack.
- Scrubbing
- Filtering attack traffic out on a large network before the clean traffic is passed on to the target.
- Probe
- A small burst of traffic used to test whether a target's defences are up, often before a bigger attack.
Knocked off, or can't get back in?
Check whether anything is blocking you, see the live state of every server, or tell us what happened and when.