Before the ddos attacks i saw a guy joining as Player 3 (ID: 57648)
He stayed in specs the whole time, which was pretty suspicious.
I'm guessing it might have been him, although i might be wrong.

Can confirm. It's very obvious its him. Within a 1hour span earlier today my server was attacked 7-8 times. I noticed the same thing with him in spec as you did Hyorgh, he'll join the server, then 10 seconds later the attacks begin and the server crashes. He dosen't play, say, or do anything.

His goal is to get the players to leave and join the servers that he hosts. "Infinity" servers as it appears to be. He'll immediately run back to his servers hoping people will join him after he crashes other servers.

[16:11:48] Player clientdata: WIN {2916352}
[16:11:48] U.S.G.N.: Player (213.233.85.197) joining with U.S.G.N. ID #57648 - verifying...
[16:11:48] U.S.G.N.: 213.233.85.197 is using U.S.G.N. ID #57648
[16:11:48] Player 2 connected
It appears he's using something called "tsource engine query" commonly used to crash game servers. Specifically counterstrike and call of duty servers from what i've read. Can see the name encoded in the actual data packets that are received by the server. img: http://f.cirium.me/attacks_04-12-2016/screen1.png

Regards,
Cirium.