Russian Hackers Dayz

[HEROTHOR]

Hello, I have this dayz server with the six core package. Everything is running perfect, except for one thing that is not necessary your challenge. I have come here to see if anyone can help. I have this Russian hacker that comes on to the server, first i've seen him with a rocket skin. I banned him immediately, he somehow managed to crash the server. Server comes back up. He joins back again, under a different alias, same GUID and IP. I ban him again. He manages to crash the server again. It is non stop with him. Can anyone help me out. I know it is an extreme task, but any help would be appreciated.

It seems like a really powerful ddosser, or something.

[soja]

When your server is offline go to the firewall tab and get a detailed capture, then open a ticket with NFO or paste the capture in pastebin and post it here.

Do you see high bandwidth spikes on your "server usage" tab, or is it normal?

Take his IP address and in the firewall tab, set it to block all incoming packets from his IP address, so if he wants to join back it would need to be through a vpn.

[HEROTHOR]

Thanks very much man, I will try this right now! Ill keep an eye on the bandwidth. Really appreciate it! Nice servers by the way!

[soja]

Thank you!

[.=QUACK=.Major.Pain]

You can look through your logs, and get the ips he is using, but he's probably changing his ips through vpn as mentioned. Probably stealing or purchasing stoling guids/accounts also so once he is globally banned, he uses another unbanned account.

Just have to keep banning any ip and guid you can get from your logs, and hopefully in time he will move on to someone elses server.

[HEROTHOR]

Whats exactly a detailed capture?


Also, I keep banning him. He logs back in under the same GUID and same IP. He even shows up in my ban list.

[.=QUACK=.Major.Pain]

If his guid is in the ban list, you might have to restart the server or reload Battleye to get the ban to stick. In an rcon tool, you would type "loadscripts".

He shouldn't get in with an ip ban either if using the same one.

[HEROTHOR]

Yeah its very weird. I'm going to capture the ddos attack next time, and sent it to NFO to block all his traffic.

[soja]

On your firewall tab you should have a checkbox next to the capture button like this:


Clicking the button with that checked is a "detailed" capture.

Blocking his client IP via the firewall page will make your server completely invisible to him. It won't show up in a server browser, he can't see if it is online, unless he uses a tool like gametracker to remotely check on the server.

[FAST]

You can also IP region ban this player


Example doing a three part ban XX.XX.XX. (best choice) or two part XX.XX. (but you will definitely prevent other players from russia signing on to your server.)

[soja]

You can also IP region ban this player


Example doing a three part ban XX.XX.XX. (best choice) or two part XX.XX. (but you will definitely prevent other players from russia signing on to your server.)

If he keeps getting the same-ish IP then he is getting a new IP from his ISP every time and this would certainly help in blocking him from doing that.

[HEROTHOR]

Yeah, considering I specate about 100% of the players from Russia now. I might aswell go ahead and ban the whole country lol. Thanks for all the help and the detailed tutorial soja! I will admit I made a noob mistake...I was looking in the remote desktop lolz. Thanks again guys!

I should update you. He came back in under a different ip, but we updated our anti-hack. I added his new ip to the firewall tab, and shortly after he got kicked for battleye client not responding. Haven't seen him since.

[.=QUACK=.Major.Pain]

Not sure if you will be able to see this page:

http://www.pbbans.com/mbi-latest50-bf3-lfb41.html

Most of the time, the banned hackers for BF3 were from Russia.
It's spread in to Europe a lot more lately.

[soja]

Yeah, considering I specate about 100% of the players from Russia now. I might aswell go ahead and ban the whole country lol. Thanks for all the help and the detailed tutorial soja! I will admit I made a noob mistake...I was looking in the remote desktop lolz. Thanks again guys!

I should update you. He came back in under a different ip, but we updated our anti-hack. I added his new ip to the firewall tab, and shortly after he got kicked for battleye client not responding. Haven't seen him since.

Awesome, glad to see you got it sorted out!