# Get help during an attack

> What to do when an address of yours is under attack right now, and how to reach Coritan quickly.

Source: https://docs.coritan.com/ddos-shield/under-attack/

In the dashboard:

- /under-attack: https://www.coritan.com/under-attack

Use this page while an attack is taking one of your services down. Tell us about the attack first, so that we know about it while you work. Then follow the steps for the address that the attack reaches. Most of them are changes you can make yourself in the dashboard.

## Tell us about the attack

1. In the [dashboard](https://www.coritan.com/dashboard/support), select **Support**, then **New conversation…**.
2. In **Subject**, name the service and say that it is under attack, such as `survival-smp under attack`.
3. Set **Priority** to Critical, and choose the service under **About a service**.
4. In **Message**, write what [What to include](#what-to-include) lists, then select **Start conversation**.
5. Call [+1 (302) 606-0504](tel:+13026060504), and give the conversation's number, such as `#1042`.

If you cannot sign in, email [support@coritan.com](mailto:support@coritan.com) and call the same number. [Contact support from the dashboard](/support/conversations/#start-a-conversation) covers the form in full.

Do not use the form on our website's attack page, which [The attack page](#the-attack-page) describes. It sends nothing.

## Find what the attack reaches

What you can do depends on the address that the attack is sent to:

| Your service is reached at | Filtered by | Steps |
|---|---|---|
| A floating IP, including the address that comes with a Cloud Compute instance | DDoS Shield | [An attack on a floating IP](#an-attack-on-a-floating-ip) |
| The shared address of a Container Apps server | — | [An attack on a shared address](#an-attack-on-a-shared-address) |
| A join address or a web proxy | Coritan's edge | [An attack on a join address or a web proxy](#an-attack-on-a-join-address-or-a-web-proxy) |
| An address with another provider | — | [A service hosted elsewhere](#a-service-hosted-elsewhere) |

The **Addresses** card on the **Overview** tab of [DDoS Shield](https://www.coritan.com/dashboard/ddos) lists every floating IP on your account, with what each one is **Attached to**. The address of a server that is not on that list is a shared address.

## An attack on a floating IP

DDoS Shield already filters every packet sent to the address ([Filtering is always on](/ddos-shield/how-ddos-shield-works/#filtering-is-always-on)). Check what it drops, then tighten the address's settings if the attack still gets through.

1. In the [dashboard](https://www.coritan.com/dashboard/ddos/events), select **DDoS Shield**, then the **Events** tab, and choose the address in the **All addresses** list. An event whose **Status** is `Mitigating` has not ended. Select it to see the **Attack** type, the **Peak** rate, the **Unique sources** and the **Sampled packets** ([Read attack events](/ddos-shield/attack-events/)).
2. Open the address's **Shield** tab: on the **Overview** tab of DDoS Shield, select **Manage** on the address's row. If the profile's mode is **Passthrough**, set **Protection mode** to **Standard** or **Custom**, then select **Save profile** ([Change the profile](/floating-ips/shield-settings/#change-the-profile)).
3. If the service is still down, add rules that fit it, so that less of the attack gets through ([Add a rule](/floating-ips/shield-settings/#add-a-rule)):
   - Add an **Allow** rule for each port your service uses, then set **When no rule matches** to **Drop**. Traffic to every other port then stops at our points of presence. Allow the UDP replies that your machine expects as well ([When no rule matches](/floating-ips/shield-settings/#when-no-rule-matches)).
   - Add a **Rate limit** rule on the service's port, so that each sender can send only so much to it.
   - When a few senders send most of the traffic, add a **Drop** rule for each one, with its address as the **Source prefix**, such as `198.51.100.7/32`. The event's **Sampled packets** show senders, and the API's `top_sources` lists the busiest ([Read attack events](/ddos-shield/attack-events/#with-the-api)).
   - In **Custom** mode, lower the rate limits that the attack goes over, such as **Packets per second per source** ([Rate limits](/floating-ips/shield-settings/#rate-limits)).

A change reaches our filtering within a minute, as the profile card says. Add what you changed to the conversation.

DDoS Shield reads packet headers only, so a flood of HTTP requests that look real passes it. For a website, put the site behind a web proxy, whose web application firewall checks each request and turns away clients that send too many ([Create a web proxy](/proxies/web-proxies/create-a-web-proxy/)).

## An attack on a shared address

DDoS Shield does not filter the shared address of a Container Apps server. An attack on it reaches the machine that runs your server and the other servers on that machine, and none of your settings can filter it.

1. Tell us about the attack, as [Tell us about the attack](#tell-us-about-the-attack) describes, with the shared address and the port.
2. Attach a floating IP to the server, so that players have an address that DDoS Shield filters ([Attach and detach a floating IP](/floating-ips/attach-and-detach/)). If you have none, order one first ([Order a floating IP](/floating-ips/order-a-floating-ip/)). The server's ports and join addresses move to the floating IP, and a running server may restart.
3. Give players the floating IP, or the server's join address, in place of the shared address.

Attaching a floating IP does not stop the attack on the shared address, which still reaches the machine.

## An attack on a join address or a web proxy

A join address and a web proxy resolve to Coritan's edge, so an attack on the name lands on the edge. The edge checks that traffic itself, and your DDoS Shield settings do not apply to it ([What the edge checks](/ddos-shield/tcp-proxy/#what-the-edge-checks)).

- When players see `Please rejoin to verify your connection.`, the edge is checking joins. Players should join again ([What players see](/proxies/join-addresses/#what-players-see)).
- When the name stops answering, tell us, with the name and the time it stopped.
- When the attack reaches your server anyway, the attackers know the server's own address. Follow the steps above for that address, and keep it private from then on ([Keep the origin's address private](/ddos-shield/tcp-proxy/#keep-the-origin-s-address-private)).

## A service hosted elsewhere

We cannot filter a service where another provider hosts it. You can put a proxy in front of two kinds of service, with a [Coritan account](/get-started/create-an-account/):

- A website can sit behind a web proxy, with the web application firewall ([Create a web proxy](/proxies/web-proxies/create-a-web-proxy/)).
- A Minecraft Java or Bedrock server can take a join address through an external server ([Connect a server you host elsewhere](/proxies/external-servers/connect-an-external-server/)).

A proxy stops an attack aimed at the name. An attack sent to the service's own address goes around it, so also move the service to a new address that you do not publish ([Keep the origin's address private](/ddos-shield/tcp-proxy/#keep-the-origin-s-address-private)).

For any other service, or to protect address ranges of your own, email [sales@coritan.com](mailto:sales@coritan.com) or call [+1 (302) 606-0504](tel:+13026060504) ([Bare metal, colocation and IP transit](/platform/sales-led-products/)).

## What to include

In the conversation, or when you call, give:

- the address or name under attack, and the port when the attack is on one;
- when the attack started, with your time zone;
- what stopped working, and for whom;
- the **Started** time and **Attack** type of each event on the **Events** tab, if there are any;
- what you have changed since the attack started.

## The attack page

The [attack page](https://www.coritan.com/under-attack) on our website, which **Under Attack?** at the top of the website opens, has a form for an attack in progress. The form sends nothing. **Request Emergency Mitigation** shows **We have received your request**, but the request reaches nobody, and nobody calls you back. Tell us as [Tell us about the attack](#tell-us-about-the-attack) describes instead.

The page gives times to detect an attack and to start mitigating it. For your floating IPs there is nothing to start, because DDoS Shield applies its checks to every packet all the time.

## Related

- [Support](/support/)
- [Read attack events](/ddos-shield/attack-events/)
- [Change a floating IP's DDoS protection](/floating-ips/shield-settings/)
- [How DDoS Shield works](/ddos-shield/how-ddos-shield-works/)
- [TCP proxy protection](/ddos-shield/tcp-proxy/)

## With the API

Open the conversation with [`POST /chat/conversations`](/api/reference/client/support/#op-post-api-v1-chat-conversations), with `priority` set to `critical` and the service's ID in `service_id` ([Create a conversation](/support/conversations/#create-a-conversation)):

```bash
curl -X POST https://api.coritan.com/api/v1/chat/conversations \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "203.0.113.10 under attack",
    "priority": "critical",
    "service_id": 214,
    "body": "UDP flood to 203.0.113.10 port 27015 since 14:02 UTC. Players cannot connect. No change on our side."
  }'
```

`service_id` here is the floating IP's service ID, the `ip_service_id` that `GET /api/v1/client/shield/status` returns ([With the API](/ddos-shield/#with-the-api)).

Then follow the attack and change the address's settings:

- `GET /api/v1/client/shield/events` returns the events, and an event's `active` is `true` while it goes on ([Read attack events](/ddos-shield/attack-events/#with-the-api)).
- `PATCH /api/v1/client/shield/subjects/{ip_service_id}/profile` changes the mode, the rate limits and what happens when no rule matches, and `POST /api/v1/client/shield/subjects/{ip_service_id}/rules` adds a rule ([Change a floating IP's DDoS protection](/floating-ips/shield-settings/#with-the-api)).

To drop one sender:

```bash
curl -X POST https://api.coritan.com/api/v1/client/shield/subjects/214/rules \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "drop-198-51-100-7", "action": "deny", "src_prefix": "198.51.100.7/32"}'
```