DDoS: What Customers Should Do During an Attack

Direct answer

If your GlassHosting game or store suddenly becomes unreachable for many networks at once, treat it as a possible flood: capture timestamps, confirm it is not just one bad Wi-Fi, open a billing ticket with evidence, and do not reinstall, doxx IPs, or paste credentials into public Discords while you wait.

Symptoms and when this is (and is not) DDoS

Real multi-path unreachability looks different from a single school network blocking games, a bad home upload, or a crashed process. Typical flood symptoms:

• Players from unrelated ISPs fail to join within the same window.
• Panel graphs or status look saturated or odd compared to a quiet night.
• Your own phone on cellular still cannot reach the service while LAN tricks “work.”

Still check the boring causes first: wrong IP:port after a reinstall, unfinished auth (especially Hytale), expired whitelist, or a stopped server. Related networking guides: CGNAT explained, home Wi-Fi vs datacenter, and friends join via IP/port.

What to do, in order

1. Note the start time in your local timezone and which product is hurt (which game server or which site).
2. Capture panel evidence without secrets: status, console tail with passwords redacted, approximate player reports.
3. Ask two players on different networks (home fiber vs cellular) whether both fail. One campus Wi-Fi fails ≠ DDoS.
4. Open a ticket at billing.glasshosting.com with timestamps and scope. Use the client area; do not DM random “mitigation” accounts.
5. Communicate calmly to your community: “we are working with the host,” not speculative attacker drama or published mitigation IPs.
6. Avoid destructive “fixes”: full reinstalls, world deletes, or credential resets that erase forensic context.

Common mistakes

• Assuming every timeout is DDoS (often it is CGNAT, wrong port, or patchline mismatch).
• Posting panel passwords, RCON, or auth codes while “asking for help.”
• Hard-reinstalling mid-incident and then wondering why logs are gone.
• Publicly announcing “we are under attack” with enough detail to invite copycats.

GlassHosting-specific workflow

GlassHosting operates the network and guest platform; you operate the community and application config. During an incident, tickets with clean timestamps beat discord ping storms. Read the matching KB article What customers should do during a DDoS attack and the broader Security and Reliability category. For game-panel basics that help you gather evidence quickly, see game panel beginner guide.

How to talk to players without making it worse

Short status beats speculation. “Joins are failing for multiple networks; we opened a host ticket at 18:40 PT” is enough. Avoid naming supposed attackers, publishing packet captures with sensitive IPs, or inviting strangers who offer “free mitigation” in DMs. Rotate panel passwords only if you have evidence of credential exposure, not as a lucky charm mid-incident.

After the spike

1. Confirm the service is reachable from two networks again.
2. Write down what you observed for the ticket thread (even if the flood already stopped).
3. Review whether public endpoints, RCON, or auth codes leaked during the scramble.
4. If you run Minecraft, Hytale, Palworld, or Rust, re-check that the panel process is the build you expect. Panic restarts sometimes leave you on a surprise jar.

Platform DDoS posture is described for customers in DDoS protection: what is included (read it for scope, not as a promise of zero bad days). Pair application hardening with calm process: strong secrets, least-privilege panel users, and no public admin surfaces.

Related guides

• Dedicated IP explained
• CGNAT explained
• Hytale hosting guide (auth/port confusion can mimic “attacks”)
• Leave home PC hosting