DDoSDefender

Development has moved to a Premium Model. To receive continued updates and support, please visit our new home.

---

DDoSDefender delivers high-performance mitigation by injecting a sophisticated network handler directly into your server's Netty pipeline. By inspecting handshake packets and source IP addresses in real time, the system applies dynamic rate limiting and selective packet cancellation to neutralise malicious bursts instantly.

Furthermore, DDoSDefender intercepts LoginStart packets using a state-of-the-art detection suite that executes 19 individual heuristic checks — from username entropy and edit-distance clustering to UUID fingerprinting and swarm-pattern detection — achieving a 99.997% bot detection rate, based on two controlled test runs of 10,000 bots each using varied naming schemes, without sacrificing performance.

---

AccountGuard

Beyond name-pattern detection, DDoSDefender now includes AccountGuard, a per-account suspicion scoring engine that tracks reconnect behaviour, subnet volatility, and session patterns over time. Accounts are placed into one of four tiers — CLEAN, CAUTION, SUSPICIOUS, HIGH_RISK — with scores that decay naturally during normal play, so legitimate players are never permanently penalised for a rocky connection.

FastPass

DDoSDefender features our proprietary FastPass system, which allows previously verified players to bypass security checks on subsequent logins from the same network. This rewards your community with seamless connections while keeping your server protected from disruptions.

/ii fastpass add <playername> — Run as an op if a player cannot join /ii test <playername> — Instantly see how any name scores against the full detection suite, useful for tuning thresholds or investigating a specific player before taking action

---

Scope & Recommended Setup

DDoSDefender focuses exclusively on managing and filtering application-level connection attempts. It is important to note that it does not — and cannot — protect your physical network infrastructure, as no software-level plugin can mitigate volumetric attacks at the ISP level.

For comprehensive protection, we strongly recommend a layered security strategy: pair DDoSDefender/DDoSDefenderLite with a network-level proxy like TCPShield. While TCPShield shields your IP and absorbs massive network-layer floods, DDoSDefender provides the "last mile" of defence by intelligently filtering the complex, Minecraft-specific handshake exploits that proxies might pass through.