Glossary

The vocabulary of Minecraft DDoS protection

Every term that comes up when a server is under attack, defined plainly and without marketing. If you only read one, make it protocol-aware filtering — it is the difference between mitigation that understands Minecraft and mitigation that only counts packets.

These pages exist because most explanations of DDoS terminology are written for network engineers protecting web servers. Minecraft is a different problem: the traffic is a stateful game protocol, the attacks target the join path rather than the pipe, and the fix has to understand both. Definitions below are written for that context.

All terms

Layer 7 DDoS attack

L7 attack · application-layer attack

A Layer 7 DDoS attack floods the application protocol itself — for Minecraft, valid handshakes and logins — so every packet looks legitimate to anything that only inspects the network layer.

Layer 4 DDoS attack

L4 attack · network-layer attack

A Layer 4 DDoS attack floods the transport layer with connections or raw packets, aiming to exhaust bandwidth or connection-tracking state before the application layer is ever reached.

Join flood

login flood · bot attack · connection flood

A join flood is a Minecraft attack in which thousands of fake clients complete valid handshakes and attempt to join, exhausting connection slots and main-thread time rather than bandwidth.

SYN flood

TCP SYN attack

A SYN flood opens huge numbers of TCP connections without completing them, exhausting the target's connection-tracking state so legitimate connections can no longer be accepted.

UDP reflection attack

amplification attack · reflection attack

A UDP reflection attack sends spoofed requests to third-party servers so their much larger replies are aimed at the victim, multiplying the attacker's available bandwidth.

PROXY protocol

haproxy protocol · real IP forwarding

PROXY protocol is a small header prepended to a forwarded connection that carries the original client's address, letting a server behind a proxy see real client IPs instead of the proxy's.

Anycast

anycast routing · anycast network

Anycast announces one IP address from many locations simultaneously, so traffic reaches the nearest site — which both shortens routes and divides a DDoS flood across every location at once.

Null route

blackhole · RTBH · blackholing

A null route discards all traffic destined for an address, protecting the surrounding network at the cost of taking the target completely offline — finishing the attacker's job for them.

Under Attack Mode (UAM)

UAM · attack mode

Under Attack Mode is an automatic state in which a mitigation system tightens its thresholds and routes new joins through verification once attack indicators exceed a configured level.

Limbo server

limbo · verification server · holding server

A limbo server is a lightweight holding world that suspicious joins are routed into so they can be verified as real clients before ever reaching the production backend.

Minecraft handshake

handshake packet · protocol handshake

The Minecraft handshake is the first packet of any connection, declaring protocol version, the requested hostname and whether the client intends to ping or log in.

Server list ping (MOTD)

MOTD ping · status ping · status request

A server list ping is the status request that populates a server's MOTD, icon and player count in the multiplayer menu — and a common vector for cheap, high-rate floods.

Bypass bot

antibot bypass · bypass client

A bypass bot is a Minecraft bot engineered to defeat a specific antibot by behaving normally on every metric that antibot measures.

Client fingerprint

fingerprinting · connection fingerprint

A client fingerprint identifies a Minecraft client by how it behaves and what it sends, rather than by its IP address, so it remains stable when the attacker changes addresses.

Residential proxy

residential IP · proxy network

A residential proxy relays traffic through real consumer internet connections so attack traffic presents an ordinary home IP address instead of a datacenter one.

Datacenter IP

hosting ASN · datacenter range · cloud IP

A datacenter IP belongs to a hosting or cloud network rather than a consumer ISP — an origin real players rarely use and automated traffic frequently does.

Rate limiting

rate limits · connection throttling

Rate limiting caps how many connections, joins or requests a given source may make within a time window, dropping or delaying the excess.

TCP starvation

connection exhaustion · slowloris

TCP starvation exhausts a target's available connections by opening many and keeping them alive while sending as little data as possible, consuming capacity rather than bandwidth.

Geo-steering

geo routing · geographic load balancing

Geo-steering routes each player to the nearest healthy backend for their location, letting one network serve multiple regions at local latency.

Scrubbing center

scrubbing · clean pipe · traffic scrubbing

A scrubbing center filters attack traffic out of a redirected traffic stream and forwards the clean remainder to the origin.

Your next attack is already scheduled.
Be behind the edge when it lands.

We take care of security so you can branch out. Free plan, no card, one DNS record — if it doesn't hold, you lost five minutes.