DDoSDefender

# DDoSDefender 2.0: The Big One DDoSDefender 2.0 is a full rebuild. Almost every part of the plugin has been rewritten, it now runs on **Paper, BungeeCord/Waterfall, Velocity and Folia** *(Still in Beta)*, and it introduces a brand-new **shared player database**. DDoSDefender stays **100% free**: no premium tier, no licences, no locked features. --- ## ✨ New features ### 🌐 NEW: Shared player database DDoSDefender now comes with a database of **known, real Minecraft accounts**. When a player joins, DDoSDefender can confirm their account **instantly and locally** instead of asking Mojang every time. Joins are faster, Mojang's rate limits are no longer a weak spot, and bots using made-up accounts are spotted straight away. - Downloaded automatically on first start (about 450 MB on disk) - Kept up to date every few hours in the background, with **no restart needed** - When a real account that isn't in the database yet joins your server and Mojang confirms it, it's added for everyone, so the database keeps growing *(you can turn this off with `report-new-players: false`)* ### 🛡️ Under-attack mode (automatic) DDoSDefender now spots **distributed attacks**: bots replaying real player names from many networks at once. - Turns on by itself when **10+ failed account verifications come from 5+ different networks within 2 minutes** - While it's on, **only frequent players (FastPass) can join**. Everyone else is asked to try again in a few minutes. - One newcomer is let through every 15 seconds as a probe, so DDoSDefender knows when the attack has stopped (and real new players still get a chance) - Turns itself **off after 5 quiet minutes** - Manual control: `/ddosdefender lockdown on | off | status` ### 🔔 Attack alerts - A clear console alert when an attack is detected and when it ends - **In-game chat alerts for staff** (operators by default, or anyone with `iudex.alerts`) ### 🧠 Failed-login learning When a connection fails Minecraft's own account check (someone pretending to be a real player), DDoSDefender remembers it: - That IP is blocked for **60 seconds**, doubling on every repeat up to **1 hour** - **3 failures from the same network in 10 minutes** block the whole network for **10 minutes** - Real accounts are never blocked. Only the networks the fake logins come from are. ### ⚖️ Smart Mojang lookup budget Mojang only allows so many lookups, and bots used to be able to use them all up so real newcomers couldn't be checked. Lookups are now **shared out by how suspicious a name looks**: - Normal-looking names can use the whole budget - Slightly suspicious names get at most 60% of it, and very suspicious ones 30% - Obvious bot names never use a lookup at all ### ⚡ FastPass: up to 3 networks FastPass now remembers **up to 3 networks per player** (for example home, mobile data and a friend's house), so regulars get straight in wherever they usually play from. When a player starts using a 4th network, the one they've used least recently is forgotten. ### 📊 Cleaner console - The spammy "Malicious Traffic Nullified" lines that printed every 10 seconds are gone - Now: **one summary every 15 minutes**, only printed if something was actually blocked > *DDoSDefender has nullified 4,812 malicious connections from 37 networks in the last 15 minutes* - Plus a single **heavy-traffic warning** if a large burst hits (at most once a minute) ### 🔌 More platforms and setups - **Velocity** support fixed: DDoSDefender now loads and protects Velocity proxies properly - **BungeeCord / Waterfall** fully supported - **TCPShield**: real player IPs are read automatically from TCPShield's signed data, with no extra setup - **Geyser / Floodgate**: Bedrock players are recognised and handled correctly - **Offline-mode servers**: account checks switch off automatically, so cracked servers no longer block everyone - **ViaVersion-friendly**: clients from 1.7 up to future versions are accepted, instead of only a fixed list of versions - *Note: Folia support is still in Beta.* --- ## 🔐 Security and privacy The database was built with abuse in mind from day one: - **Encrypted and locked to your server:** each server receives its own protected copy. - **Privacy first:** the database holds no readable usernames or personal data, only what's needed to recognise genuine accounts. - **Tamper-proof:** DDoSDefender only accepts data that is verified and is coming from the official database server, so nobody can feed it fake information. - **Abuse-resistant:** registrations and downloads are protected and rate-limited, so the database can't be scraped or flooded. - **Hardened infrastructure:** the database server is firewalled, rate-limited and has no open ports. - **Minimal data:** the only thing ever sent back is the UUID and name of a newly confirmed account. **Player IP addresses and server details are never sent.** --- ## 🔍 Smarter bot detection The name checks were retuned using **over 300,000 real player names**: - Real players flagged as suspicious: **25.9% → 3.3%** - Real players hard-blocked by name alone: **0.23% → 0.01%** - Bot names are still caught at high rates (78–91% depending on the bot's naming style) - New checks: **letter-pair plausibility** (spots keyboard-mash names) and **random casing** (spots names like `xQ7kZpLmVb`) --- ## 🐛 Bug fixes - Fixed `trusted-proxies` not being read correctly on BungeeCord and Velocity - Fixed the default `expected-port` blocking every player on proxy and port-forwarded setups (it now defaults to `0`, meaning don't check) - Fixed older and newer Minecraft versions being refused when using ViaVersion / ViaBackwards - Fixed temporary Mojang outages wrongly marking real accounts as "not found" - Fixed pre-1.19 clients being rejected too easily - Fixed signature data being lost for 1.19.0–1.19.2 clients - Fixed listeners doubling up after a plugin reload - Fixed a slow memory leak in the login queue - Fixed kick messages failing silently on Waterfall - Fixed server-list pings sometimes being answered with a login packet --- ## 🧹 Under the hood - Complete code rewrite into a clean, readable structure that's easier to maintain and faster to update - Verification runs off the main thread, so lag spikes from attacks are a thing of the past - **AccountGuard has been removed.** Its job is now covered better by the database, failed-login learning and under-attack mode. --- ## ⌨️ Commands and permissions `/ddosdefender` (aliases: `/ii`, `/iudex`, `/iudexindustries`) | Command | Permission | What it does | |---|---|---| | `/ddosdefender fastpass add <player>` | `iudex.fastpass` | Pre-approve a player who can't get in | | `/ddosdefender test <player>` | `iudex.test` | See how a name scores against the bot checks | | `/ddosdefender lockdown on\|off\|status` | `iudex.lockdown` | Control under-attack mode | | — | `iudex.alerts` | Receive in-game attack alerts | All permissions are given to operators by default on Paper/Spigot. On BungeeCord and Velocity, give them through your permissions plugin. --- ## ⬆️ Upgrading from 1.x 1. Install **PacketEvents 2.13+** (required on every platform) 2. **Delete your old `config.yml`** and let 2.0 create a fresh one. Several options changed (`expected-host` was removed, and `trusted-proxies` and `bedrock-prefix` were added). 3. On first start, DDoSDefender registers your server and downloads its database copy. This takes a few minutes, and your server stays protected while it happens. **Requires:** Java 17+ · PacketEvents 2.13+ --- > *DDoSDefender filters malicious connections at the application level. No plugin can stop volumetric floods that overwhelm your network connection itself. For full protection, pair DDoSDefender with a network-level proxy such as **TCPShield**.*

Added Support for: - Bungeecord - Waterfall - Folia Added: trusted-proxies: (to config.yml)

## V1.80 — Smarter Bot Detection **Detection suite: 19 → 27 checks**, with 8 new checks targeting bot naming patterns — keyboard walks (`qwerty`, `asdfgh`), digit-stuffed names, `xX_Name_Xx` wrappers, impersonation of default names (`Player123`, `Guest42`), attack-tool vocabulary, and counter-driven name floods (`name1`, `name2`, `name3`...). **AccountGuard reworked** — previously tracked everything by player name, so bots using a fresh unique name every connection reset its memory each time. It now also tracks reputation per subnet (IP range), so repeat bad behavior from the same source is actually remembered. **How enforcement works now:** - 🟢 **Allow** — normal players, untouched - 🟡 **Verify** — suspicious activity silently triggers a Mojang ownership check. Real players pass invisibly; offline/spoofed bots don't. - 🔴 **Block** — a single name is blocked briefly (60s) for hammering; a whole subnet is only blocked (30s) for extreme, sustained floods **Legitimate players are protected** — returning regulars skip extra scrutiny entirely, and nobody is blocked just because someone else on their subnet is misbehaving. **Also fixed:** connection frequency is now actually used in scoring (previously tracked but ignored), short-session detection can properly escalate again, and a memory cap was added to stop flood attacks from bloating server memory. No config changes needed — just update and go.

**Added Support for:** 26.2, 26.1, 1.18

- **FastPass: removed synchronous save-on-verify from the login hot path** — FastPass.save() used to run on every successful login verification, rewriting and re-encrypting the whole data file each time. As the verified-player list grew, this got slower and slower, blocking a thread with disk I/O on every new join. Verified names are now cached in memory and only flushed to disk periodically (same pattern as AccountGuard.cleanup() / MojangAPI.cleanup()) and on shutdown. Logins are no longer blocked by file I/O, and this fixes a major performance bug. - **Added: bStats**

# DDOSDefenderPE — Patch Notes **Iudex Industries | Internal Build** ## Security Vulnerabilities Patched ### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering Minecraft's TCP stack buffers packets. When a handshake is cancelled by `HandshakeListener`, a `LoginStart` packet already in the buffer would still fire in `LoginStartListener` — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood `LoginStart` checks with no cooldown applied. **Fix:** `LoginStartListener` now maintains its own fully independent rate limiter (identical values to `HandshakeListener`: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first. --- ### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second. **Fix:** `TrustedIPs` class removed entirely. FastPass was reverted to subnet-based verification (`/24` for IPv4, `/48` for IPv6), and `HandshakeListener` was reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic. --- ### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification. **Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright. --- ### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes. **Fix:** FastPass now stores the subnet (`/24` for IPv4, `/48` for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification. --- ### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely. **Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change. --- ### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation When a connection was cancelled with `event.setCancelled(true)`, no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster. **Fix:** All cancellation paths now call `DisconnectHelper.sendAndClose()`, which sends a `WrapperLoginServerDisconnect` packet before closing the connection. Clients receive a proper disconnect reason and do not auto-retry. --- ### 🟢 [LOW] `getConnectionId()` NPE on unresolved socket addresses `LoginStartListener.getConnectionId()` called `address.getAddress().getHostAddress()` without null-checking `address.getAddress()`. Unresolved `InetSocketAddress` instances (possible with certain proxy/VPN forwarding configurations) would throw a `NullPointerException` on the executor thread, silently dropping the connection without cleanup. **Fix:** Added `|| address.getAddress() == null` guard — returns null (treated as unknown connection) instead of throwing.

# DDOSDefenderPE — Patch Notes **Iudex Industries | Internal Build** ## Security Vulnerabilities Patched ### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering Minecraft's TCP stack buffers packets. When a handshake is cancelled by `HandshakeListener`, a `LoginStart` packet already in the buffer would still fire in `LoginStartListener` — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood `LoginStart` checks with no cooldown applied. **Fix:** `LoginStartListener` now maintains its own fully independent rate limiter (identical values to `HandshakeListener`: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first. --- ### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second. **Fix:** `TrustedIPs` class removed entirely. FastPass was reverted to subnet-based verification (`/24` for IPv4, `/48` for IPv6), and `HandshakeListener` was reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic. --- ### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification. **Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright. --- ### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes. **Fix:** FastPass now stores the subnet (`/24` for IPv4, `/48` for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification. --- ### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely. **Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change. --- ### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation When a connection was cancelled with `event.setCancelled(true)`, no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster. **Fix:** All cancellation paths now call `DisconnectHelper.sendAndClose()`, which sends a `WrapperLoginServerDisconnect` packet before closing the connection. Clients receive a proper disconnect reason and do not auto-retry. --- ### 🟢 [LOW] `getConnectionId()` NPE on unresolved socket addresses `LoginStartListener.getConnectionId()` called `address.getAddress().getHostAddress()` without null-checking `address.getAddress()`. Unresolved `InetSocketAddress` instances (possible with certain proxy/VPN forwarding configurations) would throw a `NullPointerException` on the executor thread, silently dropping the connection without cleanup. **Fix:** Added `|| address.getAddress() == null` guard — returns null (treated as unknown connection) instead of throwing.

# DDOSDefenderPE — Patch Notes **Iudex Industries | Internal Build** ## Security Vulnerabilities Patched ### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering Minecraft's TCP stack buffers packets. When a handshake is cancelled by `HandshakeListener`, a `LoginStart` packet already in the buffer would still fire in `LoginStartListener` — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood `LoginStart` checks with no cooldown applied. **Fix:** `LoginStartListener` now maintains its own fully independent rate limiter (identical values to `HandshakeListener`: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first. --- ### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second. **Fix:** `TrustedIPs` class removed entirely. FastPass was reverted to subnet-based verification (`/24` for IPv4, `/48` for IPv6), and `HandshakeListener` was reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic. --- ### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification. **Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright. --- ### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes. **Fix:** FastPass now stores the subnet (`/24` for IPv4, `/48` for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification. --- ### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely. **Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change. --- ### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation When a connection was cancelled with `event.setCancelled(true)`, no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster. **Fix:** All cancellation paths now call `DisconnectHelper.sendAndClose()`, which sends a `WrapperLoginServerDisconnect` packet before closing the connection. Clients receive a proper disconnect reason and do not auto-retry. --- ### 🟢 [LOW] `getConnectionId()` NPE on unresolved socket addresses `LoginStartListener.getConnectionId()` called `address.getAddress().getHostAddress()` without null-checking `address.getAddress()`. Unresolved `InetSocketAddress` instances (possible with certain proxy/VPN forwarding configurations) would throw a `NullPointerException` on the executor thread, silently dropping the connection without cleanup. **Fix:** Added `|| address.getAddress() == null` guard — returns null (treated as unknown connection) instead of throwing.

# DDoSDefenderPE — Patch Notes — Release V1.40 *by Iudex Industries* --- ## ⚠ Critical **FastPass encryption upgraded to authenticated encryption.** > Action required: delete your existing FastPass.txt before deploying — old entries are incompatible. --- ## Bug Fixes - **FastPass** — Encryption vulnerability patched; tampering is now detected on load. - **Login tracking** — Race condition under concurrent load resolved. - **Queue** — Stale entries no longer re-injected after expiry. - **IPv6** — Connections now correctly grouped by subnet for rate limiting. - **HandshakeListener** — Connections failing early checks no longer proceed to login. - **HandshakeListener** — Internal maps are now bounded and cleaned up under attack conditions. - **HPV port check** — Clients can no longer self-report an arbitrary port to bypass the check. - **Protocol Update** — Updated The Protocol Check to Match the Current Protocol. --- ## New Checks — 4 added (18 total) - **Check15** — UUID version & variant fingerprinting. - **Check16** — Username entropy analysis. - **Check17** — Edit-distance clustering to catch near-identical name swarms. - **Check18** — Degenerate name pattern detection.

# DDoSDefenderPE — Patch Notes — Release V1.40 *by Iudex Industries* --- ## ⚠ Critical **FastPass encryption upgraded to authenticated encryption.** > Action required: delete your existing FastPass.txt before deploying — old entries are incompatible. --- ## Bug Fixes - **FastPass** — Encryption vulnerability patched; tampering is now detected on load. - **Login tracking** — Race condition under concurrent load resolved. - **Queue** — Stale entries no longer re-injected after expiry. - **IPv6** — Connections now correctly grouped by subnet for rate limiting. - **HandshakeListener** — Connections failing early checks no longer proceed to login. - **HandshakeListener** — Internal maps are now bounded and cleaned up under attack conditions. - **HPV port check** — Clients can no longer self-report an arbitrary port to bypass the check. - **Protocol Update** — Updated The Protocol Check to Match the Current Protocol. --- ## New Checks — 4 added (18 total) - **Check15** — UUID version & variant fingerprinting. - **Check16** — Username entropy analysis. - **Check17** — Edit-distance clustering to catch near-identical name swarms. - **Check18** — Degenerate name pattern detection.