Malicious activity on my kf2 server [HELP]

[Dave1]

I believe the culprit could be this name which joined my server repeatedly: MR Bullet-Proof

Attacking from an IP in Manchester, UK

Often when my server is live, I get repeated messages in-game "MR Bullet-Proof joined, MR Bullet-Proof left" basically over and over. He never stayed long enough to ban him on the admin panel and I really didn't care.

This morning I get an email from my VPS provider saying there has been suspicious activity detected on my vps must be reinstalled. I check the logs and yep, the attacks were all made against my server on the port 7777 (which kf2 uses). This was NOT the normal DDOS email, they disabled my vps to protect their greater network apparently...

Are there any security vulnerabilities with the kf2 server? Or just my server host overreacting? I have been DDOSed many times, hosted many different game servers but never had an email like this, and never had to reinstall my server because of it.

I can ban the guy on kf2 and block him from my server but I am sure he can just get another IP and steam account. What are my options here? I am only a script kiddie who hosted a kf2 server because the devs removed the listen server function, I don't really know how to take this further.

[Leon]

first thing you need to do is remove his profile link from thsi thread, it is against steam term of use.

2nd thing you can steam id ban him, if he gets another ID, this way even if he changed IP, it won't work, unless he made another account, in any case, if he made another account, you will know what SUS actions that he will do next time since he seems to repeat the same activities over and over.

change the server name, so they don't know if thats the same server, ask the providers of your server if they can maybe change the IP of the server you're hosting, if that is possible.

[Dave1]

Originally posted by Leon:

first thing you need to do is remove his profile link from thsi thread, it is against steam term of use.

Thanks, I edited the OP

Originally posted by Leon:

change the server name, so they don't know if thats the same server, ask the providers of your server if they can maybe change the IP of the server you're hosting, if that is possible.

I don't like this strategy, it seems like running away.

[Mister Torgue Flexington]

Originally posted by Leon:

first thing you need to do is remove his profile link from thsi thread, it is against steam term of use.

2nd thing you can steam id ban him, if he gets another ID, this way even if he changed IP, it won't work, unless he made another account, in any case, if he made another account, you will know what SUS actions that he will do next time since he seems to repeat the same activities over and over.

change the server name, so they don't know if thats the same server, ask the providers of your server if they can maybe change the IP of the server you're hosting, if that is possible.

typically I would agree with you on this, that it is indeed against the ToS. but at the same time, if what the OP says is true, about whoever this guy is infecting (and corrupting) his server, let alone his system, this guy deserves to be named-and-shamed!!!!

[Pricetx]

There's an ongoing thread relating to this week's DoS issue on the forum: https://forums.tripwireinteractive.com/index.php?threads/kf2-server-on-centos-linux-ddos-defense-with-the-help-of-firewalld.2337631/