We are experiencing a DDoS attack from Subst3r, anyone knows him ?
 

Hi everyone,

We are facing a massive DDoS attack from one guy whose nickname is "Subst3r". It blocks our embedders, our site wp-script.com and even the products activation.

Anyone knows him or faced problems due to him ?

Do you get a political message like India in some beef with Pakistan.

Nothing but a well writing message threatening us of more than jsut a DDoS attack..

Index.php and another link.php along with folders tampered with. Every wp script under same user name.

also adds a index.html?

Is it an attack on http? Are you using cloudflare or mojocloud?

Yes we are using Cloudflare since yesterday but it's not 100% useful for now unfortunately

You need to swap your ips, if you didn't have cloudflare before.

Yes we already swap IPs yesterday but it seems like it didn't work perfectly

No host here can tackle proper ddos. Few hosts can try to help, depending what you're facing. Cloudflare is a start. Also check you're not leaking the ip somewhere. Getting behind cloudflare is not everything, you need to hide all ip spills.
Also, your site might be hacked for all we know and he might be constantly getting proper ip's from there and what not. If you know who it is, then write how you know and what does he want. Someone doesn't ddos someone for no reason. There's usually some monetary interest at hand, or you did something you shouldn't have in circles you shouldn't have been in.