Right now: the first ten minutes
- Identify what's hitting you from the symptoms — it changes nothing about the fix but tells you what to expect: massive lag or total unreachability = volumetric flood; console spam of connections/disconnections = connection or join flood; server-list weirdness and ping storms = Layer-7 protocol abuse. (Full diagnostic guide.)
- Do not pay a ransom. Attackers sometimes message demanding money to stop. Paying flags you as profitable and guarantees repeat attacks.
- Do not restart in a loop. The attack targets your IP, not your process. Endless restarts just churn your players and your host's tolerance.
- Tell your players once, in Discord: "we're under attack, fix in progress" — it stops the flood of tickets and rumor.
- Save evidence if you may involve your host or authorities: timestamps, console logs, any ransom messages.
Why nothing you do on the server itself will work
Plugins, kernel tweaks, and firewall rules on the box all share the same problem: they act after the traffic has already crossed your host's network to reach you. The scarce resources — the pipe, the connection table, your host's patience before a null-route — are consumed upstream of anything you control. Stopping a DDoS means changing the geometry: players connect to a big anycast edge, the flood is absorbed and filtered there, and only clean, Minecraft-validated traffic is forwarded to you. That's what Arvoris does — Cloudflare Spectrum's 500+ Tbps edge in 330+ cities, then Cryo's Minecraft-aware Layer-7 filtering on AS216013, then your backend.
Getting behind the edge during an active attack
Setup works fine mid-attack because none of it happens on the machine being flooded: you work in the Arvoris panel and your DNS provider. Create a network (the free plan is enough to get protected), set your server's address as the backend, verify your domain, point `play.yourdomain.com` at your edge endpoint via CNAME, and enable PROXY protocol on your proxy or Paper config so real IPs keep working.
The honest caveat is DNS TTL. If your old A record had a TTL of an hour, players whose resolvers cached it keep connecting to the old IP until the cache expires — so relief ramps up over minutes to hours rather than landing instantly. The attack also keeps pounding the old IP for a while; that's fine, it's no longer where your players are. Once things settle, get a fresh IP or port from your host (or firewall the old allocation to Arvoris-only) so the leaked address is worthless, and lower your DNS TTL to something short so any future change propagates fast.
Prevention checklist
| Stay behind the edge | Protection isn't an incident tool — the win is that the next booter run never reaches you at all |
| Never re-leak the backend | Don't post the raw IP in Discord, server lists or status pages; players only ever see the domain |
| Enable PROXY protocol | Real player IPs on every plan, and direct connections to the backend fail — bypass attempts die |
| Firewall the backend | Accept traffic only from Arvoris; everything else drops at the kernel |
| Turn on antibot | The verification gauntlet stops join floods and bot waves that pure network filtering can't distinguish from players |
| Keep DNS TTL low | 300s means any future backend move or emergency change takes minutes, not hours |
Common questions
My server is being DDoSed right now — what's the fastest fix?+
Put a protection layer in front of it. Create a free Arvoris network (about five minutes), point your backend at your server, switch your domain's DNS to the edge, and enable PROXY protocol. New connections start flowing through the filter as soon as DNS propagates; the attack keeps hitting your old IP, which no longer matters.
Should I pay the ransom to make the attack stop?+
No, never. Paying proves you'll pay, and the same attacker — or their friends — will be back with a higher price. Booter time costs them almost nothing, so there's no economics on your side of that trade. Spend the money on protection instead; the free tier costs $0.
Will restarting my server stop a DDoS attack?+
No. The flood targets your IP address, not your server process — it's still arriving while the server boots, so you come back up into the same storm, often with a corrupted-feeling join rush on top. Restart once if the server is wedged, then stop restarting and fix the network path.
Can my host stop the attack for me?+
Sometimes they filter small attacks, but the common response to a large one is a null-route: they take your IP offline to protect their other customers, which completes the attack for the attacker. That's why the durable fix is an edge in front of the host, not a ticket to the host.
How long until protection actually takes effect?+
Panel setup takes about five minutes. The variable is DNS: if your old record had a high TTL, some players' resolvers keep returning the old IP until it expires — so returning players trickle onto the protected path over minutes to hours. Attacks aimed at your old IP continue but stop mattering once players are on the new path; rotating to a fresh backend IP afterwards cleans up completely.
How do I stop the next attack before it starts?+
Stay behind the edge permanently, never publish your backend IP again, firewall the backend to accept only Arvoris traffic, and keep PROXY protocol on so direct connections fail. After that, booters aimed at your domain hit anycast capacity designed for exactly this — the largest attack absorbed to date is 7.15 Tbps.
Ten minutes of setup now beats every future emergency: create a free network, and the next $5 booter purchase aimed at your community buys nothing.