R-DDoS (Reverse Distributed Denial of Service)
Definition: A networking phenomenon occurring in shared-tenancy environments (such as bot hosting platforms or NAT-
based networks) where a
single internal client generates a high volume of outbound traffic toward an external API or service, triggering a global IP-
based rate limit or reputation block.
Impact: Because the external service (e.g., Discord, GitHub, or Cloudflare) perceives all traffic from the shared outbound IP address as a
single source, the defensive block is applied to the entire IP. This results in a "denial of service" for all other legitimate users on that same node, despite their individual processes remaining compliant with API guidelines.
Key Characteristics:
Directionality: Unlike a standard DDoS which is Inbound (external sources attacking a target), an
R-DDoS is Outbound (one internal source causing an external lockout).
Collateral Damage: The primary victims are "neighbor" tenants who share the same network interface.
Trigger: Usually caused by credential stuffing, API scraping, or poorly optimized loops in a
single user’s script.
The Pterodactyl node is currently experiencing an
R-DDoS; a
rogue bot triggered a 1-hour global rate limit on the shared
IP, taking all other bots on the node offline.
