R-DDoS (Reverse Distributed Denial of Service)
Definition: A networking phenomenon occurring in shared-tenancy environments (such as bot hosting platforms or NAT-
based networks) where a single internal client generates a high volume of outbound traffic toward an external API or service, triggering a global IP-
based rate limit or reputation
block.
Impact: Because the external service (e.g.,
Discord, GitHub, or Cloudflare) perceives all traffic from the shared outbound IP address as a single source, the defensive block is applied to the entire IP. This results in a "denial of service" for all other legitimate users on that same node, despite their individual processes remaining compliant with API guidelines.
Key Characteristics:
Directionality: Unlike a standard DDoS which is Inbound (external sources attacking a
target), an R-DDoS is Outbound (
one internal source causing an external lockout).
Collateral Damage: The primary victims are "neighbor" tenants who share the same network interface.
Trigger: Usually caused by credential stuffing, API scraping, or poorly optimized loops in a single user’s script.
The Pterodactyl node is currently experiencing an R-DDoS; a
rogue bot
triggered a
1-hour global rate limit on the shared IP, taking all other bots on the node offline.
