NeoProtect down

treesmokah · October 30

Looks like they ate a massive attack and Datapacket(their only upstream that was also used for mitigation of large attacks) has nullrouted them. All locations are down, and downstreams are affected.

Last update:

https://bgp.tools/as/199414
https://status.neoprotect.net/incidents/kdmtx0wk3h1l

MikeA · October 30

I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.
Edit: There's many large dedicated server companies like Limestone that use Neoprotect, I'm guessing that means all of the clients of those datacenters/server providers that have IPs for mitigation are also down eh, pretty bad situation to be in.

For them to get dropped from CDN77/DP is surprising. I use them in Singapore and they've eaten multi-terabit attacks against some of my clients with no problems.

treesmokah · October 30

@MikeA said: I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.

They use them for pre-filtering basically, they have their own filtering for more sophisticated and application layer attacks, but all these big attacks are tanked by DP.
NeoProtect doesn't have much of their "own" capacity, they heavily rely on Datapacket filtering large attacks.

They have updated their status with this, now

Neoon · October 30

@treesmokah said:

@MikeA said: I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.

They use them for pre-filtering basically, they have their own filtering for more sophisticated and application layer attacks, but all these big attacks are tanked by DP.
NeoProtect doesn't have much of their "own" capacity, they heavily rely on Datapacket filtering large attacks.

They have updated their status with this, now

Spicy, now they know a few TB's will make the BGP sessions drop.
It doesn't even have to last for one hour to take them down for 1 day or more.

treesmokah · October 30

@Neoon said:

@treesmokah said:

@MikeA said: I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.

They use them for pre-filtering basically, they have their own filtering for more sophisticated and application layer attacks, but all these big attacks are tanked by DP.
NeoProtect doesn't have much of their "own" capacity, they heavily rely on Datapacket filtering large attacks.

They have updated their status with this, now

Spicy, now they know a few TB's will make the BGP sessions drop.
It doesn't even have to last for one hour to take them down for 1 day or more.

To be fair, I don't blame Datapacket for dropping them at all, realistically NeoProtect are a small customer abusing the fuck out of DP's dirt cheap, large capacity ddos protection.
Datapacket charges only $100 for their "advanced" protection, that they use all the time to tank massive attacks, its their entire business model.

As i said, they had little of own capacity, and only filtered what wasn't already filtered by DP protection.

Afaik these recent attacks caused issues for the whole Datapacket infra.

It reminds me of TCPShield getting kicked out of OVH recently, because entire Miami location was having issues due to their attacks. It operated in a similar fashion, abusing low-cost mitigation.

Edit: I have no idea if NeoProtect also paid $100 per location, like I was quoted, they could have some special agreement that I'm not aware of, but judging by how this situation was handled, I doubt it.

Neoon · October 30

@treesmokah said:

@Neoon said:

@treesmokah said:

@MikeA said: I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.

They use them for pre-filtering basically, they have their own filtering for more sophisticated and application layer attacks, but all these big attacks are tanked by DP.
NeoProtect doesn't have much of their "own" capacity, they heavily rely on Datapacket filtering large attacks.

They have updated their status with this, now

Spicy, now they know a few TB's will make the BGP sessions drop.
It doesn't even have to last for one hour to take them down for 1 day or more.

To be fair, I don't blame Datapacket for dropping them at all, realistically NeoProtect are a small customer abusing the fuck out of DP's dirt cheap, large capacity ddos protection.
Datapacket charges only $100 for their "advanced" protection, that they use all the time to tank massive attacks, its their entire business model.

As i said, they had little of own capacity, and only filtered what wasn't already filtered by DP protection.

Afaik these recent attacks caused issues for the whole Datapacket infra.

So you telling me, they gonna Deadpool next week?

treesmokah · October 30

@Neoon said:

@treesmokah said:

@Neoon said:

@treesmokah said:

@MikeA said: I've never used Neoprotect or any services like them so excuse my ignorance, but do they just rely on CDN77/DP for volumetric mitigation? I always assumed they had their own filtering and could use any upstream.

They use them for pre-filtering basically, they have their own filtering for more sophisticated and application layer attacks, but all these big attacks are tanked by DP.
NeoProtect doesn't have much of their "own" capacity, they heavily rely on Datapacket filtering large attacks.

They have updated their status with this, now

Spicy, now they know a few TB's will make the BGP sessions drop.
It doesn't even have to last for one hour to take them down for 1 day or more.

To be fair, I don't blame Datapacket for dropping them at all, realistically NeoProtect are a small customer abusing the fuck out of DP's dirt cheap, large capacity ddos protection.
Datapacket charges only $100 for their "advanced" protection, that they use all the time to tank massive attacks, its their entire business model.

As i said, they had little of own capacity, and only filtered what wasn't already filtered by DP protection.

Afaik these recent attacks caused issues for the whole Datapacket infra.

So you telling me, they gonna Deadpool next week?

Afaik pretty much their all infra was just dedis from Datapacket, rented. So if they were to get kicked out entirely, I could see it being a massive issue, larger than it already is.

treesmokah · October 31

Still down, 16h and counting. So are many of their downstreams, which appeared to be singlehomed with NeoProtect.
No further updates have been posted to their status page.

sh97 · October 31

Latest update: they've been completed booted by CDN77.

https://status.neoprotect.net/incidents/kdmtx0wk3h1l

treesmokah · October 31

@sh97 said:
Latest update: they've been completed booted by CDN77.

https://status.neoprotect.net/incidents/kdmtx0wk3h1l

Sucks, we all benefit from more DDoS protection providers, but its completely reasonable for DP to pull the plug considering the issues these attacks brought.

Hopefully their backup "game protection" infra at OVH won't get targeted, as they would also get kicked out from there.

I would love to see their on-premise offering be competitive to something like Wanguard, there is even less of good on-premise mitigation companies, than remote.

BanatSync · October 31

R.I.P NeoProtect

JoeMerit · October 31

Bad news for all other DDOS protection providers that use CDN77/DP ?

treesmokah · November 1

@JoeMerit said:
Bad news for all other DDOS protection providers that use CDN77/DP ?

Yup, looks like it. I've heard of other providers also getting a boot from CDN77/DP for using them as a pre-filter.

Again, a reasonable move from DP, but sucks. All it took was game hosting kids to ruin it all.

For comparison, real enterprise DDoS mitigaton as Akamai Prolexic, see nowhere close 30 Tbps attacks
https://www.akamai.com/blog/security/akamai-blocked-419-tb-of-malicious-traffic with 1.4 Tbps peak
https://www.akamai.com/blog/security/ddos-attack-trends-2024-signify-sophistication-overshadows-size this year they've said it was still one of the biggest attacks, seems like they had something around 2 Tbps in Oct 2024, but its still nowhere close what game servers attract.

And they aren't charging $100/mo for their protection

It all comes down to skiddery, and virtual dick measuring contests among gamers with access to botnets.
Afaik the attacks against NeoProtect were directed at Rust servers at one of their downstreams, and now it has moved to Path.

treesmokah · November 6

Datapacket has introduced new policies, they now have AUP, DMCA, and DSA policies.

Here is the new DDoS protection policy

3.10. Prohibited DDoS-Filtering Services and Excessive DDoS Traffic

Customers shall not use the Services to operate, provide, or resell any standalone DDoS-filtering, DDoS-mitigation, traffic-scrubbing, reverse-proxy, or GRE-tunnel protection services for third parties or for IP space not assigned by Supplier to Customer's services. Supplier-provided DDoS protection may be used solely to safeguard the Customer's own services running on Supplier hardware and Supplier-assigned IP space. Any operation of such services within the Supplier's network for third parties or for IP space not assigned by Supplier to Customer's services constitutes a material breach of this AUP.

If the Customer engages in any such prohibited activity, or if the Supplier reasonably determines that the Customer is operating or has operated DDoS-filtering or mitigation services without prior written disclosure and approval, the Supplier reserves the right to immediately suspend or terminate the Services without notice.

In addition, where the Supplier reasonably determines that a Customer is the target of excessive, sustained, or repeated DDoS attacks that materially affect the stability, performance, or integrity of the Supplier's network, the Supplier may (i) temporarily disable or suspend the affected Services to protect its infrastructure and other customers; and (ii) if such attacks persist or recur, terminate the affected Services upon written notice.

But what I find more concerning, is the following policy which is also new and allows for very broad overreach

3.8. Misinformation and Propaganda

Customers and Customer Users are prohibited from engaging in the creation, dissemination, or promotion of misinformation, propaganda, or any other content intended to deceive, manipulate, or mislead others. This prohibition includes, but is not limited to: (i) the deliberate fabrication or distortion of facts, data, or information with the intent to misinform or mislead the public or specific individuals; (ii) the use of Services to spread false narratives, conspiracy theories, or other deceptive content that could harm individuals, groups, or the public interest; and (iii) the amplification or distribution of propaganda designed to influence opinions, behaviors, or decisions through false or misleading representations.

But that's a topic for another thread. I will be avoiding Datapacket network from now on.

AuroraZero · November 6

@treesmokah said: 3.8. Misinformation and Propaganda

Customers and Customer Users are prohibited from engaging in the creation, dissemination, or promotion of misinformation, propaganda, or any other content intended to deceive, manipulate, or mislead others. This prohibition includes, but is not limited to: (i) the deliberate fabrication or distortion of facts, data, or information with the intent to misinform or mislead the public or specific individuals; (ii) the use of Services to spread false narratives, conspiracy theories, or other deceptive content that could harm individuals, groups, or the public interest; and (iii) the amplification or distribution of propaganda designed to influence opinions, behaviors, or decisions through false or misleading representations.

Good luck enforcing that one. The clause reads like a PR shield, not an enforceable policy. “Misinformation” and “propaganda” are legally slippery and you’d need to prove intent, define truth, and survive free speech challenges. The cost of litigating even one case would outweigh the clause’s value. It’s more about optics than anything substantial.

ahnlak · November 6

@AuroraZero said:

@treesmokah said: 3.8. Misinformation and Propaganda

Customers and Customer Users are prohibited from engaging in the creation, dissemination, or promotion of misinformation, propaganda, or any other content intended to deceive, manipulate, or mislead others. This prohibition includes, but is not limited to: (i) the deliberate fabrication or distortion of facts, data, or information with the intent to misinform or mislead the public or specific individuals; (ii) the use of Services to spread false narratives, conspiracy theories, or other deceptive content that could harm individuals, groups, or the public interest; and (iii) the amplification or distribution of propaganda designed to influence opinions, behaviors, or decisions through false or misleading representations.

Good luck enforcing that one. The clause reads like a PR shield, not an enforceable policy. “Misinformation” and “propaganda” are legally slippery and you’d need to prove intent, define truth, and survive free speech challenges. The cost of litigating even one case would outweigh the clause’s value. It’s more about optics than anything substantial.

It's a commercial relationship - I don't see how you're going to make a "free speech" argument stick.

AuroraZero · November 6

@ahnlak said:

@AuroraZero said:

@treesmokah said: 3.8. Misinformation and Propaganda

Customers and Customer Users are prohibited from engaging in the creation, dissemination, or promotion of misinformation, propaganda, or any other content intended to deceive, manipulate, or mislead others. This prohibition includes, but is not limited to: (i) the deliberate fabrication or distortion of facts, data, or information with the intent to misinform or mislead the public or specific individuals; (ii) the use of Services to spread false narratives, conspiracy theories, or other deceptive content that could harm individuals, groups, or the public interest; and (iii) the amplification or distribution of propaganda designed to influence opinions, behaviors, or decisions through false or misleading representations.

Good luck enforcing that one. The clause reads like a PR shield, not an enforceable policy. “Misinformation” and “propaganda” are legally slippery and you’d need to prove intent, define truth, and survive free speech challenges. The cost of litigating even one case would outweigh the clause’s value. It’s more about optics than anything substantial.

It's a commercial relationship - I don't see how you're going to make a "free speech" argument stick.

True, it’s a commercial relationship, but that doesn’t eliminate the problem. The issue isn’t whether a free speech claim “sticks,” it’s that every dispute forces the company into proving intent, defining truth, and burning legal hours. Enforcement becomes a cost sink regardless of outcome.

JoeMerit · November 6

Curious about how the other well known DDOS protection hosts that use CDN77 are handling this.

somik · November 7

@AuroraZero said:

@treesmokah said: 3.8. Misinformation and Propaganda

Customers and Customer Users are prohibited from engaging in the creation, dissemination, or promotion of misinformation, propaganda, or any other content intended to deceive, manipulate, or mislead others. This prohibition includes, but is not limited to: (i) the deliberate fabrication or distortion of facts, data, or information with the intent to misinform or mislead the public or specific individuals; (ii) the use of Services to spread false narratives, conspiracy theories, or other deceptive content that could harm individuals, groups, or the public interest; and (iii) the amplification or distribution of propaganda designed to influence opinions, behaviors, or decisions through false or misleading representations.

Good luck enforcing that one. The clause reads like a PR shield, not an enforceable policy. “Misinformation” and “propaganda” are legally slippery and you’d need to prove intent, define truth, and survive free speech challenges. The cost of litigating even one case would outweigh the clause’s value. It’s more about optics thæn anything substantial.

Honestly, you dont need that much to prove it. Just look up "defamation lawsuit".

Here in singapore, you can and will be held liable for making a facebook or social media post.

A negative comment or negative review that harms the company (or entity) can land you in legal hot water where you may be held liable and required to pay a fine to cover the monetary loss that happened "after" your post, regardless of whether it was a correlation or causation...

According to the legal advice from actual lawers:

• The legal principles relating to Facebook and social media defamation are similar to the rules that relate to normal defamation.
• Defamation is actionable even if you posted a photo, or commented on a photo or post.
• When it comes to internet defamation, the defamation may spread outside Singapore if the readers of the defamatory words are located outside Singapore.
• The time and extent of the publication would affect the amount of damages which the claimant can claim from you.
• Sharing a defamatory post (for example, by “retweeting” a tweet), can also render you liable for defamation.
• It is a good defence to a claim for social media defamation if what you said was true, was fair comment on a matter of public interest or was made as a matter of qualified privilege.

(quoted from https://www.hg.org/legal-articles/facebook-and-social-media-defamation-in-singapore-67747)

Free speech? That's only for the rich. You and I are too poor to afford it.

AuroraZero · November 7

SG has no bearing on a US company or US Law.
They may have to operate by SG law IF they have a physical presence there but as far as I know that is all. Then only that division has to abide by those laws not the entire company.

somik · November 7

@AuroraZero said:
SG has no bearing on a US company or US Law.
They may have to operate by SG law IF they have a physical presence there but as far as I know that is all. thæn only that division has to abide by those laws not the entire company.

Well, USA also has defamation law and no, free speech does not protect you from that. It is up to the court to decide:
https://www.law.cornell.edu/wex/defamation

So companies usually have some form of ToS to protect themselves from being roped in such lawsuits.

AuroraZero · November 7

@somik said:

@AuroraZero said:
SG has no bearing on a US company or US Law.
They may have to operate by SG law IF they have a physical presence there but as far as I know that is all. thæn only that division has to abide by those laws not the entire company.

Well, USA also has defamation law and no, free speech does not protect you from that. It is up to the court to decide:
https://www.law.cornell.edu/wex/defamation

So companies usually have some form of ToS to protect themselves from being roped in such lawsuits.

Prove it. If you are able then 3/4 of social media would disappear over night.

somik · November 7

@AuroraZero said:

@somik said:

@AuroraZero said:
SG has no bearing on a US company or US Law.
They may have to operate by SG law IF they have a physical presence there but as far as I know that is all. thæn only that division has to abide by those laws not the entire company.

Well, USA also has defamation law and no, free speech does not protect you from that. It is up to the court to decide:
https://www.law.cornell.edu/wex/defamation

So companies usually have some form of ToS to protect themselves from being roped in such lawsuits.

Prove it. If you are able thæn 3/4 of social media would disappear over night.

Ya, no, I am not going down that rabbit hole again. Look up your own countries cases and laws or call your lawer and ask.

Here is a good staring point: https://www.freedomforum.org/famous-defamation-cases/

gremeyer · November 7

@treesmokah said:
Datapacket has introduced new policies, they now have AUP, DMCA, and DSA policies.

A new DMCA policy is interesting, given that many VPN providers use it and attract hundreds or thousands of DMCA notices each day. Maybe it's because of that DISH lawsuit a while back, or they're just tightening their policies in general. I wonder how this will affect VPNs.

AuroraZero · November 7

Contract law in the U.S. is clear: any ambiguity in a contract is interpreted in favor of the signer, not the drafter. For that clause to be enforceable, it would need to define exactly what constitutes “defamation.”

Saying “this company sucks” is opinion is not defamation, and there’s nothing anyone can do about it. On the other hand, saying “this company steals client data” without proof could be defamation, but even then the burden is on them to prove both falsity and damages.

What you’re looking at is boilerplate jargon — it sounds intimidating, but in practice it’s just there to give the drafter cover. It doesn’t actually carry the weight they want you to think it does.

No I am not a lawyer but, I have spent my entire life dealing with the US Government.

NeoProtect down

Comments