DDoS protection for websites, TCP applications and game servers. One anycast edge to absorb volumetric floods, neutralize protocol abuse and outsmart Layer 7 botnets, with a 100% uptime SLA backed in writing.
Websites are protected at the HTTP layer, everything else over TCP and UDP. Game servers get dedicated filters for their game protocol.
For websites, online stores and APIs. Onboard via DNS in 5 minutes, no hosting migration.
A protected IP in front of your server: all traffic passes through our filters and only clean traffic reaches you. Works with any protocol over TCP and UDP.
For APIs, VPNs, mail, databases, messengers and any service of your own.
For Lineage II, Minecraft, GTA (SA-MP, RAGE:MP), CS2, Rust and other games.
Each attack class is stopped by the layer built for it. Reflection floods are absorbed at anycast ingress, SYN floods die at the stateful scrubber, and bots fail the L7 challenge. Bypass a layer to see what slips through.
Dedicated scrubbing capacity across 64 PoPs, with headroom above the largest attack we've absorbed.
to 95% of the world's internet users
90-day uptime · 100% SLA on Enterprise
41 countries · 312 peering partners
detection → drop,
no BGP swing needed
Q3 2026 · UDP reflection · zero customer impact
Built for teams who can't afford a single dropped request, from game launches to payment rails.
Volumetric, protocol and application attacks are stopped by the same edge, with the same rules, inside the same microsecond budget.
baseline per endpoint · 2.1B features/s · auto-challenge at ≥ 0.90
rule "protect-login" { when http.path matches "^/api/(login|auth)" and rate(ip.src, 10s) > 20 and not bot.verified then challenge(js) | log}Every plan includes unmetered DDoS mitigation. Pick a product: web protection, TCP application protection or game server protection.
For startups and single applications.
For revenue-critical platforms.
For networks that bring their own IPs.
For a single service or API.
For production services under load.
For infrastructure across several servers.
To connect, we need your server IP address and ports. No server migration required.
For a new or small project.
For projects with a serious online.
For top projects and launches.
Your game isn’t listed? Message us on Telegram and we will build a filter for your protocol.
| Feature | Edge | Shield | Fortress | Enterprise |
|---|
We will pick a plan, help with onboarding and answer any question. Engineers are on shift 24/7, with a median reply time of 4 minutes.
Message @on_protectCan't find what you need? Our network engineers answer in minutes, not tickets.
Immediately. onProtect is always-on and inline, so there is no detection-then-reroute delay. Median time from first malicious packet to drop is 0.38 ms across our edge, and no BGP announcement changes are needed for proxied zones.
Web protection works with HTTP and HTTPS: you point your domain to us via DNS and we filter requests, bots and L7 attacks. TCP protection covers every other protocol: you get a protected IP address, traffic to it passes through our filters, and only clean traffic reaches your server.
Lineage II, Minecraft, GTA (SA-MP, RAGE:MP), CS2, Rust and other games over TCP and UDP. Popular games have ready-made protocol filters; for the rest we build a filter for your server build. Real players are never blocked.
Never. All plans include unmetered DDoS mitigation. You pay for clean bandwidth delivered to your origin, so a 3 Tbps attack costs you exactly the same as a quiet Tuesday.
Websites and APIs usually onboard via DNS in about five minutes. If you need to protect whole networks, non-HTTP services or your own IP space, use BGP onboarding: we announce your prefixes and deliver clean traffic over GRE, IPsec or a private interconnect.
Typically it reduces it. Traffic enters the nearest of our 64 PoPs (under 10 ms for 95% of users), where TLS is terminated and connections to your origin are pooled and kept warm.
Yes, on Fortress and Enterprise. The minimum is a /24 for IPv4 or a /48 for IPv6. We handle LOAs, IRR objects and RPKI validation with your team during onboarding.
Anycast routes withdraw automatically and traffic converges on the next-closest PoP in under a second. Mitigation state is shared across the fabric, so attacks stay blocked while they move.
SOC 2 Type II, ISO/IEC 27001 and PCI DSS v4.0 Level 1, plus GDPR DPAs, HIPAA BAAs and regional data-processing controls on Enterprise.