[M. Bison]

Some members of the WT-F community are targeting our servers. A few attacks were directly linked to them.

One of the attackers, [WTF] backwards [DEV], made no effort to hide the source of the attack nor his involvement. He sent unspoofed attack traffic from his test server, 199.116.118.27 [IMG], and did so immediately after connecting in-game.


Here is part of a TCPDump showing the attack traffic in question:

19:21:56.397878 IP (tos 0x28, ttl 117, id 23619, offset 0, flags [DF], proto UDP (17), length 38)
   199.116.118.27.59718 > 74.91.113.123.27015: [udp sum ok] UDP, length 10
       0x0000:  4528 0026 5c43 4000 7511 aff5 c774 761b  E(.&\[email protected].
       0x0010:  4a5b 717b e946 6987 0012 92e5 fdff ffff  J[q{.Fi.........
       0x0020:  4c5a 5353 8302                           LZSS..
19:21:56.397881 IP (tos 0x28, ttl 117, id 23620, offset 0, flags [DF], proto UDP (17), length 34)
   199.116.118.27.59718 > 74.91.113.123.27015: [udp sum ok] UDP, length 6
       0x0000:  4528 0022 5c44 4000 7511 aff8 c774 761b  E(."\[email protected].
       0x0010:  4a5b 717b e946 6987 000e 4888 ffff ffff  J[q{.Fi...H.....
       0x0020:  6b15                                     k.
19:21:56.397883 IP (tos 0x28, ttl 117, id 23621, offset 0, flags [DF], proto UDP (17), length 34)
   199.116.118.27.59718 > 74.91.113.123.27015: [udp sum ok] UDP, length 6
       0x0000:  4528 0022 5c45 4000 7511 aff7 c774 761b  E(."\[email protected].
       0x0010:  4a5b 717b e946 6987 000e 4888 ffff ffff  J[q{.Fi...H.....
       0x0020:  6b15                                     k.

Accounts:
STEAM_0:0:16583896 [main acc]
STEAM_0:0:16229287 [vac'd]
STEAM_0:0:17462301 [offering DOS services]

more proof:

1. detailed series of events
   
2. suspicious pattern
   
3. busted!!
   
4. third alt acct found, check aliases
   
5. history on his main account
   

[Black Blood]

pathetic..

http://www.wt-f.com/forum/index.php?/top...ty-banned/
They were also blamed for ddosing the kill4 servers

i will cut my hand off if they didnt ddos wL servers back in feb )

[M. Bison]

i will cut my hand off if they didnt ddos wL servers back in feb )

I'm not entirely sure whether they were involved in the larger 40Gbps DDoS attacks. However, it's beginning to look like they were behind most or all of the subsequent smaller attacks we suffered around the time of relocating to Texas and Kansas. At the time, a few people even suggested as much. I guess they were right... backwards' presence on the (wL) servers is tied to dates we were attacked. It looks like he's been at this a while.

[RJU]

They're just sad and trying to deny DDoSing us even though you have the proof right there..

Heh and yet they cant man up and admit it lol

They are also kicking people with the wL name tag because it's "advertising". What a bunch of hypocrites.

Edit: I've been told multiple times by a WT-F admin not to wear the wL community tag months before this so just change the kicking to banning. Thanks for pointing that out smartass. Give yourself pat in the back.

Why WT-F is DDoS-ing US server? I'm from asia and I'm kinda new to warlords. Is there any feud between the two community?

[Riser]

Why WT-F is DDoS-ing US server? I'm from asia and I'm kinda new to warlords. Is there any feud between the two community?

Back in Feb last year, wL was hit with a huge DDoS that took out most of our US servers.. 4 of our mostly populated servers died because of it. Shortly earlier or later (can't remember), WT-F set up a Popular Maps server and most of our regulars moved on to that server. We decided to set up Kill4 as a sub community of wL and now they're being attacked as we populate them. Bison traced it back to the said guy, not sure if he is acting of behalf of WT-F or just himself.

This is what I remember, probably missing some details.