DDoSDefender

DDoSDefender 2.0: The Big One

DDoSDefender 2.0 is a full rebuild. Almost every part of the plugin has been rewritten, it now runs on Paper, BungeeCord/Waterfall, Velocity and Folia (Still in Beta), and it introduces a brand-new shared player database. DDoSDefender stays 100% free: no premium tier, no licences, no locked features. ---

New features

NEW: Shared player database

DDoSDefender now comes with a database of known, real Minecraft accounts. When a player joins, DDoSDefender can confirm their account instantly and locally instead of asking Mojang every time. Joins are faster, Mojang's rate limits are no longer a weak spot, and bots using made-up accounts are spotted straight away. - Downloaded automatically on first start (about 450 MB on disk) - Kept up to date every few hours in the background, with no restart needed - When a real account that isn't in the database yet joins your server and Mojang confirms it, it's added for everyone, so the database keeps growing (you can turn this off with `report-new-players: false`)

Under-attack mode (automatic)

DDoSDefender now spots distributed attacks: bots replaying real player names from many networks at once. - Turns on by itself when 10+ failed account verifications come from 5+ different networks within 2 minutes - While it's on, only frequent players (FastPass) can join. Everyone else is asked to try again in a few minutes. - One newcomer is let through every 15 seconds as a probe, so DDoSDefender knows when the attack has stopped (and real new players still get a chance) - Turns itself off after 5 quiet minutes - Manual control: /ddosdefender lockdown on | off | status

Attack alerts

- A clear console alert when an attack is detected and when it ends - In-game chat alerts for staff (operators by default, or anyone with iudex.alerts)

Failed-login learning

When a connection fails Minecraft's own account check (someone pretending to be a real player), DDoSDefender remembers it: - That IP is blocked for 60 seconds, doubling on every repeat up to 1 hour - 3 failures from the same network in 10 minutes block the whole network for 10 minutes - Real accounts are never blocked. Only the networks the fake logins come from are.

Smart Mojang lookup budget

Mojang only allows so many lookups, and bots used to be able to use them all up so real newcomers couldn't be checked. Lookups are now shared out by how suspicious a name looks: - Normal-looking names can use the whole budget - Slightly suspicious names get at most 60% of it, and very suspicious ones 30% - Obvious bot names never use a lookup at all

FastPass: up to 3 networks

FastPass now remembers up to 3 networks per player (for example home, mobile data and a friend's house), so regulars get straight in wherever they usually play from. When a player starts using a 4th network, the one they've used least recently is forgotten.

Cleaner console

- The spammy "Malicious Traffic Nullified" lines that printed every 10 seconds are gone - Now: one summary every 15 minutes, only printed if something was actually blocked > DDoSDefender has nullified 4,812 malicious connections from 37 networks in the last 15 minutes - Plus a single heavy-traffic warning if a large burst hits (at most once a minute)

More platforms and setups

- Velocity support fixed: DDoSDefender now loads and protects Velocity proxies properly - BungeeCord / Waterfall fully supported - TCPShield: real player IPs are read automatically from TCPShield's signed data, with no extra setup - Geyser / Floodgate: Bedrock players are recognised and handled correctly - Offline-mode servers: account checks switch off automatically, so cracked servers no longer block everyone - ViaVersion-friendly: clients from 1.7 up to future versions are accepted, instead of only a fixed list of versions - Note: Folia support is still in Beta. ---

Security and privacy

The database was built with abuse in mind from day one: - Encrypted and locked to your server: each server receives its own protected copy. - Privacy first: the database holds no readable usernames or personal data, only what's needed to recognise genuine accounts. - Tamper-proof: DDoSDefender only accepts data that is verified and is coming from the official database server, so nobody can feed it fake information. - Abuse-resistant: registrations and downloads are protected and rate-limited, so the database can't be scraped or flooded. - Hardened infrastructure: the database server is firewalled, rate-limited and has no open ports. - Minimal data: the only thing ever sent back is the UUID and name of a newly confirmed account. Player IP addresses and server details are never sent. ---

Smarter bot detection

The name checks were retuned using over 300,000 real player names: - Real players flagged as suspicious: 25.9% → 3.3% - Real players hard-blocked by name alone: 0.23% → 0.01% - Bot names are still caught at high rates (78–91% depending on the bot's naming style) - New checks: letter-pair plausibility (spots keyboard-mash names) and random casing (spots names like xQ7kZpLmVb) ---

Bug fixes

- Fixed trusted-proxies not being read correctly on BungeeCord and Velocity - Fixed the default expected-port blocking every player on proxy and port-forwarded setups (it now defaults to 0, meaning don't check) - Fixed older and newer Minecraft versions being refused when using ViaVersion / ViaBackwards - Fixed temporary Mojang outages wrongly marking real accounts as "not found" - Fixed pre-1.19 clients being rejected too easily - Fixed signature data being lost for 1.19.0–1.19.2 clients - Fixed listeners doubling up after a plugin reload - Fixed a slow memory leak in the login queue - Fixed kick messages failing silently on Waterfall - Fixed server-list pings sometimes being answered with a login packet ---

Under the hood

- Complete code rewrite into a clean, readable structure that's easier to maintain and faster to update - Verification runs off the main thread, so lag spikes from attacks are a thing of the past - AccountGuard has been removed. Its job is now covered better by the database, failed-login learning and under-attack mode. ---

Commands and permissions

/ddosdefender (aliases: /ii, /iudex, /iudexindustries) | Command | Permission | What it does | |---|---|---| | /ddosdefender fastpass add <player> | iudex.fastpass | Pre-approve a player who can't get in | | /ddosdefender test <player> | iudex.test | See how a name scores against the bot checks | | /ddosdefender lockdown on\|off\|status | iudex.lockdown | Control under-attack mode | | — | iudex.alerts | Receive in-game attack alerts | All permissions are given to operators by default on Paper/Spigot. On BungeeCord and Velocity, give them through your permissions plugin. ---

Upgrading from 1.x

1. Install PacketEvents 2.13+ (required on every platform) 2. Delete your old `config.yml` and let 2.0 create a fresh one. Several options changed (expected-host was removed, and trusted-proxies and bedrock-prefix were added). 3. On first start, DDoSDefender registers your server and downloads its database copy. This takes a few minutes, and your server stays protected while it happens. Requires: Java 17+ · PacketEvents 2.13+ ---

DDoSDefender filters malicious connections at the application level. No plugin can stop volumetric floods that overwhelm your network connection itself. For full protection, pair DDoSDefender with a network-level proxy such as TCPShield.