Why rival servers attack each other

At nine in the evening the server stops answering. It comes back, then drops again. Players get timeouts, and by the time the host's filter catches up half of them are playing somewhere that stayed online. That exodus explains the suspicion and sometimes the attack: knocking a rival offline is cheap, nobody can prove who paid, and the players it drives away have to go somewhere.

An evening of downtime is cheap

When police took down webstresser.org in April 2018, Europol called it the world's biggest marketplace for DDoS attacks. It had more than 136,000 registered users and sold attacks from €15 a month, and about four million attacks had been measured by then. Europol listed victims in the gaming industry alongside banks and government services, and noted that a nominal fee was enough for people with little or no technical knowledge to launch attacks.

The price is the point. The attacker pays for a subscription and picks the evening. The target pays for filtering every month whether or not anyone attacks (what DDoS protection actually buys), and still loses players while the filter catches up.

Everyone has a motive

When a server goes down under a flood, the owner's first thought is usually the rival a few places up the list. Sometimes that is right. Player populations are close to zero-sum at the moments that matter, such as a wipe or a launch, and an outage at one of those moments moves players for good.

The same evening has other suspects, most with a motive at least as strong. A player banned an hour earlier. A clan that lost a raid. A former admin who left after a row, or someone who plans to ask for money to make it stop. The extortion version is well documented. The people behind the Mirai botnet, who pleaded guilty in the United States in December 2017, used it mainly against online gaming servers, Minecraft ones in particular, while running a company that sold protection against DDoS attacks, according to KrebsOnSecurity's report on the pleas. The report describes them hitting organisations and then either demanding money to stop or offering to sell the mitigation.

Europol's prevention work suggests who many of the buyers are. Its campaigns show warning adverts to young people searching Google for DDoS-for-hire tools, and its April 2026 announcement reported more than 100 URLs advertising DDoS-for-hire services removed from search results.

The traffic carries no name

A flood arrives from thousands of addresses that belong to other people: hijacked cameras and routers, and misconfigured servers used as reflectors. The customer who paid never touches the target, and nothing in a packet capture or the host's graphs identifies them. The records that link a buyer to a target sit with the booter itself, which is why police can sometimes do what victims cannot. In an action week that began on 13 April 2026 under Operation PowerOFF, 21 countries took down 53 domains and issued 25 search warrants, four people were arrested, and more than 75,000 users identified from seized data received warning emails or letters. The seized records covered over 3 million accounts.

That kind of attribution arrives months or years after the evening in question, and it rarely arrives at the server owner's door. For the owner the attack is anonymous by design, which is why the useful defences are about exposure rather than identity (stopping attacks on a small server).

The asymmetry at the bottom

A small server on a budget VPS with one public address has no capacity to absorb a flood, and many budget hosts respond to a large attack by null-routing the target address to protect the rest of their network. The host's defence finishes the attacker's job, and the server stays dark until the route comes back.

Bigger networks spread across filtered addresses and proxies and record the same attack as a line in a report. Protection has become a running cost of hosting anything competitive, in the same column as the machine and the domain. In practice that means a host with filtering built for game traffic, and an origin address that never appears in public DNS records or old connection strings. Where the game supports a proxy, the proxy goes in front (where server security actually fails).

Why naming a rival backfires

There is no evidence to show, only timing and motive, and both fit the banned player just as well. The rival may be under attack the same week. A public accusation starts a feud between two communities that outlasts the attack, and it gives anyone who enjoys the chaos, the attacker included, a second evening of entertainment (drama as a structural problem). If the accusation turns out to be wrong it cannot be withdrawn in any way that matters, and the server that made it becomes known for the accusation rather than the outage.

The morning after an attack

The useful steps are dull. Keep the host's incident details: the times, the sizes, the addresses that were hit and any demand that arrived. Report to the host, and to the police cybercrime reporting service in your country, because investigations are built from patterns of reports even when nothing comes back to you. Do not pay an extortion demand, since paying marks the server as one that pays. Tell players what happened in plain words without naming anyone. Then close whatever exposed the origin address, because the same subscription can buy the same evening again next week.