Description
Gallery
Changelog
Versions
DDoSDefender delivers high-performance mitigation by injecting a sophisticated network handler directly into your server's Netty pipeline. By inspecting handshake packets and source IP addresses in real time, the system applies dynamic rate limiting and selective packet cancellation to neutralise malicious bursts instantly.
Furthermore, DDoSDefender intercepts LoginStart packets using a state-of-the-art detection suite that executes 19 individual heuristic checks — from username entropy and edit-distance clustering to UUID fingerprinting and swarm-pattern detection — achieving a 99.997% bot detection rate, based on two controlled test runs of 10,000 bots each using varied naming schemes, without sacrificing performance.
AccountGuard
Beyond name-pattern detection, DDoSDefender now includes AccountGuard, a per-account suspicion scoring engine that tracks reconnect behaviour, subnet volatility, and session patterns over time. Accounts are placed into one of four tiers — CLEAN, CAUTION, SUSPICIOUS, HIGH_RISK — with scores that decay naturally during normal play, so legitimate players are never permanently penalised for a rocky connection. (More to AccountGuard Soon)
FastPass
DDoSDefender features our proprietary FastPass system, which allows previously verified players to bypass security checks on subsequent logins from the same network. This rewards your community with seamless connections while keeping your server protected from disruptions.
/ii fastpass add <playername> — Run as an op if a player cannot join
/ii test <playername> — Instantly see how any name scores against the full detection suite, useful for tuning thresholds or investigating a specific player before taking action
Scope & Recommended Setup
DDoSDefender focuses exclusively on managing and filtering application-level connection attempts. It is important to note that it does not — and cannot — protect your physical network infrastructure, as no software-level plugin can mitigate volumetric attacks at the ISP level.
For comprehensive protection, we strongly recommend a layered security strategy: pair DDoSDefender/DDoSDefenderLite with a network-level proxy like TCPShield. While TCPShield shields your IP and absorbs massive network-layer floods, DDoSDefender provides the "last mile" of defence by intelligently filtering the complex, Minecraft-specific handshake exploits that proxies might pass through.
DDoSDefender's detection pipeline is fully async and runs off the main server thread, so mitigation doesn't cost you TPS. That said, performance scales with the number of CPU threads available to your server — more threads means faster processing of concurrent connections during a flood — so we recommend running on a host with adequate CPU headroom rather than a heavily oversold/shared core.
All Versions
+ Add Version
[1.9] DDoSDefender Beta V1.9
by Unknown on Oct 15, 2026
Download
Added Support for:
Added:
trusted-proxies:
(to config.yml)
- Bungeecord
- Waterfall
- Folia
Added:
trusted-proxies:
(to config.yml)
[V1.8] DDoSDefender Beta V1.8
by Unknown on Oct 15, 2026
Download
## V1.80 — Smarter Bot Detection
No config changes needed — just update and go.
- Detection suite: 19 → 27 checks**, with 8 new checks targeting bot naming patterns — keyboard walks (
qwerty,asdfgh), digit-stuffed names,xX_Name_Xxwrappers, impersonation of default names (Player123,Guest42), attack-tool vocabulary, and counter-driven name floods (name1,name2,name3...).
- AccountGuard reworked** — previously tracked everything by player name, so bots using a fresh unique name every connection reset its memory each time. It now also tracks reputation per subnet (IP range), so repeat bad behavior from the same source is actually remembered.
- How enforcement works now:**
- 🟢 **Allow** — normal players, untouched
- 🟡 **Verify** — suspicious activity silently triggers a Mojang ownership check. Real players pass invisibly; offline/spoofed bots don't.
- 🔴 **Block** — a single name is blocked briefly (60s) for hammering; a whole subnet is only blocked (30s) for extreme, sustained floods
- Legitimate players are protected** — returning regulars skip extra scrutiny entirely, and nobody is blocked just because someone else on their subnet is misbehaving.
- Also fixed:** connection frequency is now actually used in scoring (previously tracked but ignored), short-session detection can properly escalate again, and a memory cap was added to stop flood attacks from bloating server memory.
No config changes needed — just update and go.
[V1.7] DDoSDefender Release V1.7
by Unknown on Oct 15, 2026
Download
- Added Support for:**
[V1.6] DDoSDefender Release V1.6
by Unknown on Oct 15, 2026
Download
- FastPass: removed synchronous save-on-verify from the login hot path** — FastPass.save() used to run on every successful login verification, rewriting and re-encrypting the whole data file each time. As the verified-player list grew, this got slower and slower, blocking a thread with disk I/O on every new join. Verified names are now cached in memory and only flushed to disk periodically (same pattern as AccountGuard.cleanup() / MojangAPI.cleanup()) and on shutdown. Logins are no longer blocked by file I/O, and this fixes a major performance bug.
- Added: bStats**
[V1.5] DDoSDefender Release V1.5
by Unknown on Oct 15, 2026
Download
# DDOSDefenderPE — Patch Notes
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
### 🟢 [LOW]
- Iudex Industries | Internal Build**
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
HandshakeListener, a LoginStart packet already in the buffer would still fire in LoginStartListener — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood LoginStart checks with no cooldown applied.- Fix:**
LoginStartListenernow maintains its own fully independent rate limiter (identical values toHandshakeListener: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first.
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
- Fix:**
TrustedIPsclass removed entirely. FastPass was reverted to subnet-based verification (/24for IPv4,/48for IPv6), andHandshakeListenerwas reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
- Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
- Fix:** FastPass now stores the subnet (
/24for IPv4,/48for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
- Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
event.setCancelled(true), no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster.- Fix:** All cancellation paths now call
DisconnectHelper.sendAndClose(), which sends aWrapperLoginServerDisconnectpacket before closing the connection. Clients receive a proper disconnect reason and do not auto-retry.
### 🟢 [LOW]
getConnectionId() NPE on unresolved socket addressesLoginStartListener.getConnectionId() called address.getAddress().getHostAddress() without null-checking address.getAddress(). Unresolved InetSocketAddress instances (possible with certain proxy/VPN forwarding configurations) would throw a NullPointerException on the executor thread, silently dropping the connection without cleanup.- Fix:** Added
|| address.getAddress() == nullguard — returns null (treated as unknown connection) instead of throwing.
[V1.5] DDoSDefender Release V1.5
by Unknown on Oct 15, 2026
Download
# DDOSDefenderPE — Patch Notes
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
### 🟢 [LOW]
- Iudex Industries | Internal Build**
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
HandshakeListener, a LoginStart packet already in the buffer would still fire in LoginStartListener — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood LoginStart checks with no cooldown applied.- Fix:**
LoginStartListenernow maintains its own fully independent rate limiter (identical values toHandshakeListener: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first.
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
- Fix:**
TrustedIPsclass removed entirely. FastPass was reverted to subnet-based verification (/24for IPv4,/48for IPv6), andHandshakeListenerwas reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
- Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
- Fix:** FastPass now stores the subnet (
/24for IPv4,/48for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
- Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
event.setCancelled(true), no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster.- Fix:** All cancellation paths now call
DisconnectHelper.sendAndClose(), which sends aWrapperLoginServerDisconnectpacket before closing the connection. Clients receive a proper disconnect reason and do not auto-retry.
### 🟢 [LOW]
getConnectionId() NPE on unresolved socket addressesLoginStartListener.getConnectionId() called address.getAddress().getHostAddress() without null-checking address.getAddress(). Unresolved InetSocketAddress instances (possible with certain proxy/VPN forwarding configurations) would throw a NullPointerException on the executor thread, silently dropping the connection without cleanup.- Fix:** Added
|| address.getAddress() == nullguard — returns null (treated as unknown connection) instead of throwing.
[V1.5] DDoSDefender Release V1.5
by Unknown on Oct 15, 2026
Download
# DDOSDefenderPE — Patch Notes
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
### 🟢 [LOW]
- Iudex Industries | Internal Build**
## Security Vulnerabilities Patched
### 🔴 [CRITICAL] Rate-limit bypass via LoginStart packet buffering
Minecraft's TCP stack buffers packets. When a handshake is cancelled by
HandshakeListener, a LoginStart packet already in the buffer would still fire in LoginStartListener — completely bypassing the per-subnet and global rate limiters. This meant an attacker could send a burst of handshakes, have them all cancelled, but still flood LoginStart checks with no cooldown applied.- Fix:**
LoginStartListenernow maintains its own fully independent rate limiter (identical values toHandshakeListener: per-subnet 1-second cooldown, global soft limit 25/s, hard limit 50/s). The rate-limit gate runs before any other logic. Re-injected packets (players passing verification) are exempt via the verified/pending connection check, which runs first.
### 🟠 [HIGH] TrustedIPs allowed single device to push unlimited accounts
The TrustedIPs system stored exact IPs (not subnets) and allowed those IPs to bypass the global login rate limit entirely. One device that had already been verified could send an unlimited number of accounts through the queue, defeating the global hard cap of 50 logins/second.
- Fix:**
TrustedIPsclass removed entirely. FastPass was reverted to subnet-based verification (/24for IPv4,/48for IPv6), andHandshakeListenerwas reverted to blocking all connections above the rate limit with no trusted bypass. Fast-path verification is now handled purely by AccountGuard + FastPass tier logic.
### 🟠 [HIGH] FastPass bypassed AccountGuard completely for CAUTION/SUSPICIOUS accounts
FastPass-verified players were allowed through unconditionally regardless of their AccountGuard tier, including SUSPICIOUS accounts. This meant a player who had been flagged as suspicious (score ≥ 60) could exploit their FastPass entry to skip Mojang API verification.
- Fix:** FastPass now only provides a fast-path for CLEAN and CAUTION tiers. SUSPICIOUS still forces Mojang API verification (if not FastPass subnet-matched). HIGH_RISK blocks FastPass players outright.
### 🟠 [HIGH] FastPass stored exact IP, allowing subnet change to bypass re-verification
FastPass stored the player's exact IP at the time of verification. Changing IP (DHCP renewal, VPN, mobile network) would cause a FastPass miss and fall through to full re-verification — but the old exact-IP entry remained, which could have been exploited if subnet assumptions were relaxed in future changes.
- Fix:** FastPass now stores the subnet (
/24for IPv4,/48for IPv6) instead of the exact IP. A player on the same subnet passes instantly. A subnet change triggers re-verification.
### 🟡 [MEDIUM] AccountGuard penalised every rapid reconnect individually, causing false-positive death spirals
The reconnect scoring system added score on every individual fast reconnect (gap < 5s → +30, 5–30s → +15, 30s–3min → +5). A player falsely flagged and blocked would reconnect to check remaining time, each reconnect adding more score. When the block expired, their score was still above the HIGH_RISK threshold and they were immediately re-blocked — indefinitely.
- Fix:** Reconnect scoring is now pattern-based. A single rapid reconnect scores zero (impatience). Only sustained patterns of 2+ rapid gaps (< 20s) or 3+ moderate gaps (< 90s) accumulate score. Additionally, reconnect scoring is skipped entirely while the player is blocked — reconnecting to check remaining time produces zero score change.
### 🟡 [MEDIUM] No disconnect packet sent on connection cancellation
When a connection was cancelled with
event.setCancelled(true), no Minecraft Login Disconnect packet was sent to the client. Minecraft clients that receive no response auto-retry the connection immediately, creating a reconnect loop that amplifies attack traffic and causes bots to hammer the server faster.- Fix:** All cancellation paths now call
DisconnectHelper.sendAndClose(), which sends aWrapperLoginServerDisconnectpacket before closing the connection. Clients receive a proper disconnect reason and do not auto-retry.
### 🟢 [LOW]
getConnectionId() NPE on unresolved socket addressesLoginStartListener.getConnectionId() called address.getAddress().getHostAddress() without null-checking address.getAddress(). Unresolved InetSocketAddress instances (possible with certain proxy/VPN forwarding configurations) would throw a NullPointerException on the executor thread, silently dropping the connection without cleanup.- Fix:** Added
|| address.getAddress() == nullguard — returns null (treated as unknown connection) instead of throwing.
[V1.4] DDoSDefender Release V1.40
by Unknown on Oct 15, 2026
Download
# DDoSDefenderPE — Patch Notes — Release V1.40
## ⚠ Critical
## Bug Fixes
## New Checks — 4 added (18 total)
- by Iudex Industries*
## ⚠ Critical
- FastPass encryption upgraded to authenticated encryption.**
## Bug Fixes
- FastPass** — Encryption vulnerability patched; tampering is now detected on load.
- Login tracking** — Race condition under concurrent load resolved.
- Queue** — Stale entries no longer re-injected after expiry.
- IPv6** — Connections now correctly grouped by subnet for rate limiting.
- HandshakeListener** — Connections failing early checks no longer proceed to login.
- HandshakeListener** — Internal maps are now bounded and cleaned up under attack conditions.
- HPV port check** — Clients can no longer self-report an arbitrary port to bypass the check.
- Protocol Update** — Updated The Protocol Check to Match the Current Protocol.
## New Checks — 4 added (18 total)
- Check15** — UUID version & variant fingerprinting.
- Check16** — Username entropy analysis.
- Check17** — Edit-distance clustering to catch near-identical name swarms.
- Check18** — Degenerate name pattern detection.
[V1.4] DDoSDefender Release V1.40
by Unknown on Oct 15, 2026
Download
# DDoSDefenderPE — Patch Notes — Release V1.40
## ⚠ Critical
## Bug Fixes
## New Checks — 4 added (18 total)
- by Iudex Industries*
## ⚠ Critical
- FastPass encryption upgraded to authenticated encryption.**
## Bug Fixes
- FastPass** — Encryption vulnerability patched; tampering is now detected on load.
- Login tracking** — Race condition under concurrent load resolved.
- Queue** — Stale entries no longer re-injected after expiry.
- IPv6** — Connections now correctly grouped by subnet for rate limiting.
- HandshakeListener** — Connections failing early checks no longer proceed to login.
- HandshakeListener** — Internal maps are now bounded and cleaned up under attack conditions.
- HPV port check** — Clients can no longer self-report an arbitrary port to bypass the check.
- Protocol Update** — Updated The Protocol Check to Match the Current Protocol.
## New Checks — 4 added (18 total)
- Check15** — UUID version & variant fingerprinting.
- Check16** — Username entropy analysis.
- Check17** — Edit-distance clustering to catch near-identical name swarms.
- Check18** — Degenerate name pattern detection.
[V1.4] DDoSDefender Release V1.40
by Unknown on Oct 15, 2026
Download
# DDoSDefenderPE — Patch Notes — Release V1.40
## ⚠ Critical
## Bug Fixes
## New Checks — 4 added (18 total)
- by Iudex Industries*
## ⚠ Critical
- FastPass encryption upgraded to authenticated encryption.**
## Bug Fixes
- FastPass** — Encryption vulnerability patched; tampering is now detected on load.
- Login tracking** — Race condition under concurrent load resolved.
- Queue** — Stale entries no longer re-injected after expiry.
- IPv6** — Connections now correctly grouped by subnet for rate limiting.
- HandshakeListener** — Connections failing early checks no longer proceed to login.
- HandshakeListener** — Internal maps are now bounded and cleaned up under attack conditions.
- HPV port check** — Clients can no longer self-report an arbitrary port to bypass the check.
- Protocol Update** — Updated The Protocol Check to Match the Current Protocol.
## New Checks — 4 added (18 total)
- Check15** — UUID version & variant fingerprinting.
- Check16** — Username entropy analysis.
- Check17** — Edit-distance clustering to catch near-identical name swarms.
- Check18** — Degenerate name pattern detection.
[V1.3] DDoSDefender Beta V1.3
by Unknown on Oct 15, 2026
Download
Fixed a bug where players never gain access to fast-pass unless they are deemed suspicious, causing long log-in times.
[V1.3] DDoSDefender Beta V1.3
by Unknown on Oct 15, 2026
Download
Fixed a bug where players never gain access to fast-pass unless they are deemed suspicious, causing long log-in times.
[V1.3] DDoSDefender Beta V1.3
by Unknown on Oct 15, 2026
Download
Fixed a bug where players never gain access to fast-pass unless they are deemed suspicious, causing long log-in times.
[V1.2] DDoSDefender Beta V1.2
by Unknown on Oct 15, 2026
Download
Refactored LoginStart to be heavily asynchronous while retaining the ability to cancel packets; initial benchmarks show a 50% increase in throughput.
[V1.2] DDoSDefender Beta V1.2
by Unknown on Oct 15, 2026
Download
Refactored LoginStart to be heavily asynchronous while retaining the ability to cancel packets; initial benchmarks show a 50% increase in throughput.
[V1.2] DDoSDefender Beta V1.2
by Unknown on Oct 15, 2026
Download
Refactored LoginStart to be heavily asynchronous while retaining the ability to cancel packets; initial benchmarks show a 50% increase in throughput.
[V1.1] DDoSDefender Beta V1.1
by Unknown on Oct 15, 2026
Download
Added Ip to Name Matching in Fast Pass, Fixing A Security Vulnerability.
Encrypted Ips Within FastPass
Encrypted Ips Within FastPass
[V1.1] DDoSDefender Beta V1.1
by Unknown on Oct 15, 2026
Download
Added Ip to Name Matching in Fast Pass, Fixing A Security Vulnerability.
Encrypted Ips Within FastPass.
Encrypted Ips Within FastPass.
[V1.1] DDoSDefender Beta V1.1
by Unknown on Oct 15, 2026
Download
Added Ip to Name Matching in Fast Pass, Fixing A Security Vulnerability.
Encrypted Ips Within FastPass.
Encrypted Ips Within FastPass.
![Bedrock Skin Restorer [GeyserMC/Floodgate]](uploads/icons/thumbs/bedrock-skin-restorer-geysermc-floodgate_3f390f7d_thumb.jpg){kind=icon}
