R-DDoS
R-DDoS (Reverse Distributed Denial of Service)
Definition: A networking phenomenon occurring in shared-tenancy environments (such as bot hosting platforms or NAT-based networks) where a single internal client generates a high volume of outbound traffic toward an external API or service, triggering a global IP-based rate limit or reputation block.
Impact: Because the external service (e.g., Discord, GitHub, or Cloudflare) perceives all traffic from the shared outbound IP address as a single source, the defensive block is applied to the entire IP. This results in a "denial of service" for all other legitimate users on that same node, despite their individual processes remaining compliant with API guidelines.
Key Characteristics:
Directionality: Unlike a standard DDoS which is Inbound (external sources attacking a target), an R-DDoS is Outbound (one internal source causing an external lockout).
Collateral Damage: The primary victims are "neighbor" tenants who share the same network interface.
Trigger: Usually caused by credential stuffing, API scraping, or poorly optimized loops in a single user’s script.
Definition: A networking phenomenon occurring in shared-tenancy environments (such as bot hosting platforms or NAT-based networks) where a single internal client generates a high volume of outbound traffic toward an external API or service, triggering a global IP-based rate limit or reputation block.
Impact: Because the external service (e.g., Discord, GitHub, or Cloudflare) perceives all traffic from the shared outbound IP address as a single source, the defensive block is applied to the entire IP. This results in a "denial of service" for all other legitimate users on that same node, despite their individual processes remaining compliant with API guidelines.
Key Characteristics:
Directionality: Unlike a standard DDoS which is Inbound (external sources attacking a target), an R-DDoS is Outbound (one internal source causing an external lockout).
Collateral Damage: The primary victims are "neighbor" tenants who share the same network interface.
Trigger: Usually caused by credential stuffing, API scraping, or poorly optimized loops in a single user’s script.
The Pterodactyl node is currently experiencing an R-DDoS; a rogue bot triggered a 1-hour global rate limit on the shared IP, taking all other bots on the node offline.
R-DDoS by E.Crafters April 10, 2026
