DDOS attack by CraftLandia.

[Kainzo]

So with the DDoS, more than one computer is doing this to Herocraft, otherwise it would be just a DoS

Correct, its coming from 200ish different ip addies. They are zombie computers. Here's my thought process. Those "custom" hacked clients hes distroing have a zombie/botnet attached to them - so effectively, he can turn any user on his MC server into a "dos".

 

[judgedread540]

I Just had an sweet idea. I get on CraftLandia and start spying on them while this DDOS is on and I cna report back here. They wouldn't suspect of a brazilian.

(my sexy evil mind is working!)

Also their website is blocked by all non brazillian IP's so could you take a look and print screen anything you find usefull.

 

[jbird112233]

Correct, its coming from 200ish different ip addies. They are zombie computers. Here's my thought process. Those "custom" hacked clients hes distroing have a zombie/botnet attached to them - so effectively, he can turn any user on his MC server into a "dos".

This is probably true. lol feels like he is using his 2 billion users (lol) that he has into his own zombie army of dos. like the villain of a super hero movie. (to bad the villains also lose)

 

[Sniped105]

This is probably true. lol feels like he is using his 2 billion users (lol) that he has into his own zombie army of dos. like the villain of a super hero movie. (to bad the villains also lose)

In that case it's just a matter of time till this is all over . I really can't comprehend this guys logic no matter how much I think about it

 

[cmckenica]

And while you're at it @Jotamota3006, Please let me know if they even have 100+ players on.

 

[MultiHeartGold]

. Someone has an ego the size of a planet and the IQ of an ant.

You are insulting ants! And planets really arent THAT big.

 

[Fjordsen]

I have a feeling that this client is how they got their zombie computers

Same. Heck, a client in the size of 46MB surely contains more then some harmless mods. Everyone who download their client probably get their computer affected and then being used by Craftlandia's admins to their illegal purposes.

In Brazil there are nothing in their law that says DDoS attacks are illegal, so that makes it all a hole lot harder. Craftlandia tends to DDoS any server that gains about 20 or more active users in Brazil. Due to DDoS being legal in Brazil, they have not come in trouble for doing this.

Fun fact: The server owner of Craftlandia claims to have 2000 million users on actively. (2 Billion) There are 7 billion people in the world in total, so he somehow managed to get 2/7 of the world's population to play on his server. (Minecraft has sold like 6 million copies)

 

[Kainzo]

using fancy footwork atm to fix this.

 

[cmckenica]

using fancy footwork atm to fix this.

Ok honey

 

[Jotamota3006]

Ok guys. This is the first report. Downloaded the client, and it's confirmed. They use illegal client. You just need to download it, extract some folder from the zip and when you open the .bat file, minecraft is opened, only an USERNAME is required (no password required), meaning thir client is not filliated with Mojang and they don't use the Mojang verification servers.

 

[Jotamota3006]

Second report. While looking into their forums, I found the jackpot. Its a thread called "CraftLandia accused of attacking other servers", located on THIS LINK. I'm transtlatting it as we speak. For now, they say they are innocent and that they made a blog on english to prove their innocence, found HERE. Again, gimme about 10 min or so to translate the whole thread, be back in a sec!

 

[Psychokhaos]

Second report. While looking into their forums, I found the jackpot. Its a thread called "CraftLandia accused of attacking other servers", located on THIS LINK. I'm transtlatting it as we speak. For now, they say they are innocent and that they made a blog on english to prove their innocence, found HERE. Again, gimme about 10 min or so to translate the whole thread, be back in a sec!

Much thanks in you effort through this, Jota.

 

[Kourne]

The first link isn't available for me, so it might be taken down already. Seems like someone is getting scared that justice will be served for violating the law.

 

[Psychokhaos]

The first link isn't available for me, so it might be taken down already. Seems like someone is getting scared that justice will be served for violating the law.

Actually, it is due to it being on Craftlandia's website, which is made so you must use a Brazil IP to be on there - I was using brazilsurf.info yesterday to take the small look I could.

 

[Barnubus]

Screenshots are wonderful things!~

 

[Jotamota3006]

Dear ones,
We use to ignore offenses and accusations that are iniciated from a certain forum of Brazilian Miencraft that notably envy us to the bones. It must hurt on them seeing that even with all their campaign to stain the image of CraftLandia we continue to grow and break records after records almost weekly.

The leader of this campaign that has the purpose of criticizing CraftLandia is called ZidenVentania or just Ziden for some. Since 2011 this individual keeps on accusing us without a single solid proof of crashing other Brazilian servers.

What many people don't know is that while he was determined to campaign on difamating CraftLandia, he was at the same time sending us emails with his curriculum to become a part of the server's staff.

Realize how stupid this citizen is:

Copy of Ziden's email:

http://pastie.org/4460017

Obviously he was rejected of our staff, however that must only have increased his hatred, because now no more satisfied in planning a brazilian campaign to denegrate the server he is going world-wide.

I'm not detailing here the happen, but long story short he is pretending to be staff member of CraftLandia in world-wide foruns (using same nicks) with the clear intention of harming us. That is sad and at the same time pathetic.

As a response we created an english blog doing an analisis of all what has happened, and, of course, showing with the clearness of a slap in the face that there is no proof against us and there will never be one, since we don't have that kind of behaviour.

The person Ziden already created over 10 fake accounts on our forums to post about this subject, and well, this is our first and last official broadcast about this episode.

We got more important things to do than caring about the derranged thoughts of envious and bad intended subjects.

Thread closed to replies.

Atenciously,

Staff CraftLandia.

Ziden's email speaks about ideas that Ziden had for CraftLandia's plugins. He asks to be a part of the staff and says what he can do and what he has done If you guys can't get on "Kainzo's Lies" blog, I'll go copy that to this thread.

 

[Jotamota3006]

Now here's the "Kainzo's Lies" blog thread. It's a lot of stuff so I'm putting it on a spoiler bar:

Spoiler

How it started:

So this guy "Kainzo" started accusing a Brazilian server of DDoS and posting this information on a number of Minecraft related sites (bukkit, spout, mcforum). But, have you ever wondered based on what kind of proof he is claiming this?

DDoS is by nature based on a huge number of hosts and frequently from spoofed sources (read here). So how on earth Kainzo managed to track down the attack and link it to CraftLandia ? He has not.
So far, everything he has showed as a "proof" are some IRC LOGs of him supposedly arguing with some guy named "spunkiiez" that is supposedly an admin of the server Kainzo is accusing.
I mean, seriously?
First of all IRC LOGs are - easily - spoofed, and all Kainzo has is some pastebin pasted LOGs. Not even a screen shot of the real chat happening, just a plain RAW TEXT that could have easily edited.
Even more, the guy on the LOGs are just being a jerk, there's no real speak like: "I'm DDoS'ing your server right now" - It's pretty weird how ppl are trusting Kainzo without asking for some more (and real) evidence.
But, let's use our brains a little more. Even if the IRC conversation had happened exactly the way Kainzo pasted on pastebin, are we some Internet newbies that trust everyone on the web? Who guarantee that it was not a person stealing the guy's (spunkiiez) identity ?
I've just did a little research on esper IRC network and both the nicknames: spunkiiez and spunkiie are -NOT- registered. That means -YOU- may connect to IRC right now and start using his nick to curse and threaten people.
Take a look at this image (taked today):

​

Think again.. Kainzo only has some IRC LOGs on pastebin of an unregistered and unauthenticated nick from IRC that anyone could have used

That's all.
Are you going to support this without demand some REAL proof linking CraftLandia to the attacks? I mean, he is showing some network traffic graphics, but this isn't a real proof. He is telling everybody that he is taking legal actions, so we may expect he is showing the authorities some real firewall LOGs right?

I'm very sure US laws will not accept random text on pastebin as a proof.
Will you?

Community reaction.

Bukkit.

I'll post here some posts from EvilSeph (Bukkit.org lead.) and Afforess (spout.org lead). You will see both point of view and make your own conclusions.

The very first day Kainzo started his proofless campaign on bukkit.org, EvilSeph, obviously seeing that the guy had no real evidence, posted this and closed the thread immediately

​

Read it carefully and twice what EvilSeph posted and think again if it's right doing what Kainzo is trying to do.

Spout

Kainzo posted the same accusations (and the same dumb proof) also on Spout.org forum. Let's take a look at the Spout.org lead Afforess reaction.

​

So, even without real evidence besides some IRC logs of an unregistered / unauthenticated person, the "genius" guy that runs Spout.org had that nonsense reaction.

Well, now you know why mojang hired Bukkit team people instead of Spout.

Ah, and just for reference, here's another post from Afforess on the subject:

​

As you can see, Afforess tend to not ask/search for real evidence before judging.


Making some money.

Since Kainzo's proofless campaign started, he is making money from his donators that are just trying to help. I bet anyone who has some experience with Internet hosting knows that this DDoS is taking much longer than normal to get mitigated.

Maybe Kainzo is interested in making some cash of his campaign?

Worse, maybe there's even an attack happening. I'll let you guys take your conclusions, but one thing is unquestionable. It's is taking WAY MORE time to get this "problem" sorted than normal, this is at least very weird..

Here's a post from Kainzo on his forum claiming he have raised 300 USD already to "fight the attack"

​

Brazilian server owners reaction:

As a response to Kainzo campaign, some server owners from Brazil started also to blame and accuse CraftLandia of attacking their servers, so because of this they're unsuccessful with their servers (how comfortable)

They are being headed by Ziden (or ZidenVentania) that is spreading Kainzo proofless campaign by using all means.. He is also claiming spunkiiez is the lead of CraftLandia instead of an admin, which is also a lie.

Don't think he is doing this because he has a very good sense of justice. Nope.


He's doing this because he hates CraftLandia for being rejected by our team.


Here's the e-mail ZidenVentania sent to CraftLandia asking to join the team. (please use a translator):

http://pastie.org/4460017

I mean, if CraftLandia is so evil as the guy keep claiming. Why he wanted to join them in the first place?

So in fact there's no "Brazilian reaction" besides a guy that is trying to use this episode to make his personal revenge for being rejected on the team. In fact this ZidenVentaniaa guy is so much angry at CraftLandia that we are suspecting that he is the man behind the nickname 'spunkiiez' that spoke with Kainzo. Maybe this is an evil plan in progress by this guy and he is probably laughing at his home.

But it's only a suspicion, unlike Kainzo we will not accuse ppl without evidence minimally decent.

Conclusion.

Use your common sense before supporting Kainzo's misinformation campaign. Ask him for a real proof.

Don't trust the guy words blindly. We've asked him to e-mail us the evidences proving what he is saying is true. But as we already expected, no e-mail ever arrived.

It's just wrong and unfair (not to mention dumb) believe the information Kainzo has showed so far. He clearly stated on bukkit forums that "CraftLandia IP was hitting their servers" - So we may assume the guy has indeed some real evidence (firewall/server logs) of this, right?

But, now ask yourself:

1) Why he is showing only some plain-text IRC logs of an unregistered nick on pastebin?
2) Why his server is offline for so long?
3) Why he is expending more of his time spreading his campaign instead of fixing the issue/change host?

Well, there's something very wrong going on. It's up to you now.
Posted 7 hours ago by Kainzos Lies

There you go! I hope it helped. I'll be checking constantly the forum in case you guys need my help again.

 

[radicater11]

First and foremost - Herocraft isn't going anywhere. We plan to stay here for a very long time.
I didn't want to announce this because I thought it was a "oh this guy is pissed" thing. Apparently CraftLandia is known in Brazil for ddosing servers until they stop hosting a server because they want to be the #1 server in the world.

For those who don't know, DDOS = massive stop service.

http://Herocraftonline.com has been target'd because we wouldnt push out Herochat 1.3 fast enough for this server. The user Spunkiie, aka the owner of http://CraftLandia.com.br has said he will not stop DDOS'ing Herocraft until we are less than a 10 person server.

I have brought this to the attention of the developers and the community of Bukkit and they have all been very caring about what has been going on. The response from the Bukkit community has erected a large retaliation against their servers - after they tucked their tail - they stopped the DDOS last night.

Today, Evilseph (Mojang/Bukkit Lead), has removed all names / information that CraftLandia is behind this because "they dont want to be involved" so CraftLandia / Spunkiiez have resumed ddosing our services.
I am working as quickly as I can on a solution. This means we will be increasing costs by 5 to 10 times the normal rate.

I don't like leaving you in the dark here. I want to let you know whats going on. Thank you for your patience in these times. I am quite unhappy by the outcome of this and will fight tooth and nail with every dollar Herocraft has to keep us up and thwart these injustices.


Below are quotes that the Bukkit team removed and had deleted because it was "offensive" to the server in question. They are a compilation of the harassment we have received in PM's, other emails and things that this server and person have done. They told us to take down this information or the DDOS's still not stop.


Reposted here:
http://www.reddit.com/r/Minecraft/comments/xzf4m/herocraft_plugin_devs_being_ddosd_by_brazilian/
http://www.reddit.com/r/admincraft/comments/y01h1/herocraft_plugin_dev_being_ddosd_by_craftlandia/
http://forums.spout.org/threads/herocraft-dev-being-ddosd-by-spunkiiez-craftlandia-server.4562
http://www.minecraftforum.net/topic...opment-ddosd-by-brazilian-craftlandia-server/
http://herocraftonline.com/main/threads/ddos-attack-by-craftlandia.22769/

 

[radicater11]

Now with all of that info I read over all of it. Since he may have given his real name in the email you can report him to the CIA they won't do much but they might retrieve an IP. If you do get that IP then you can taunt him with it. If he goes to far you go to far aswell. He will hide under his little hole once again. Also, I think we should make a team that goes out and gets on his server. Lying about you giving up but really being spies. If we can snapshot them saying they DDos'ed - well we might be able to shut down their server. I hope this was helpful KAINZO!

-Radicater11

 

[victim130]

Isn't it illegal to DDOS? I just read into about DDOS and to me it appears illegal...

As far as I know its about 10 years maximum in North America.