DDoS protection
DDoS-protected dedicated servers, always on.
Volumetric attacks are detected and filtered at our network edge before they reach your port. Every server, every location, no extra fee and no per-attack charges.
What is covered
- UDP, SYN, ACK and ICMP floods
- Reflection and amplification (DNS, NTP, SSDP, CLDAP, memcached)
- Fragmentation and malformed-packet attacks
- HTTP floods and other Layer 7 attacks: your application’s job
Included on all servers · $0 · always on
How it works
Detect, divert, filter, return.
Mitigation runs at the edge of our network, upstream of your server, so attack traffic never competes with your real traffic on your port.
- 1
DetectTraffic volumes and packet rates are watched continuously; an anomaly triggers mitigation within seconds.
- 2
DivertOnly traffic to the attacked IP address is routed through filtering. Your other IPs are untouched.
- 3
FilterAttack packets are dropped by signature and rate; legitimate packets pass through.
- 4
ReturnClean traffic reaches your server. When the attack ends, normal routing resumes on its own.
Coverage
What we filter, and what we don’t.
Network-level protection handles the attacks that saturate links. Attacks that look like legitimate requests must be handled by your application.
| Attack type | Examples | Filtered by us |
|---|---|---|
| Volumetric floods | UDP floods, ICMP floods, fragmented packets | Yes |
| Reflection and amplification | DNS, NTP, SSDP, CLDAP, memcached, SNMP, Chargen | Yes |
| TCP state attacks | SYN, ACK and RST floods | Yes |
| Protocol-mimicking floods | Packets shaped like valid game or VoIP traffic | Volumetric part only |
| Application layer (L7) | HTTP floods, slow requests, login and API abuse | No: use a reverse proxy, rate limits or a WAF |
Your part
Layer 7: what we recommend.
Application attacks use valid requests, so only your application can tell them apart. These measures stop most of them.
Rate limitingIn your web server or reverse proxy, for example nginx
limit_req.A CDN or reverse proxyIn front of public websites, to absorb and filter HTTP floods.
fail2ban or sshguardAgainst brute-force logins, with SSH keys instead of passwords.
Game-aware proxiesFor game servers: they understand the protocol and drop bogus packets.
A tight firewallOnly expose the ports you use. Hardening guide
MonitoringAlert on request rates and error spikes, not only on server load.
FAQ
DDoS protection, explained.
Still have a question? Customers with an active server get answers from engineers in a support ticket.
Support ticketsIs DDoS protection really included on every server?
Yes. Every server in every location is behind the same always-on network-level mitigation, at no extra cost and with no per-attack fee.
Do I need to configure anything?
No. Detection and filtering happen at our network edge automatically. You only need your own application-level protections for Layer 7 attacks.
Am I billed for attack traffic?
No. Traffic is never billed, attack or not: your port is unmetered.
How quickly does mitigation start?
Usually within seconds of detection. Very short bursts can reach your server before filtering engages, which is true of every always-on system.
Will you null-route my IP?
Only as a last resort, when an attack exceeds what can be filtered or threatens other customers. We tell you when it happens, and routing returns once the attack stops.
Does it protect game servers?
It filters volumetric floods, which are the most common attacks on game servers. Attacks that imitate valid game packets need game-aware filtering on your side, such as proxy plugins or rate limits.
Guides
Related guides
- Ryzen 9 9950X vs 9950X3D for game servers: which to rent in 2026The Ryzen 9 9950X and 9950X3D share 16 Zen 5 cores and a 5.7 GHz boost; the X3D adds 64 MB of L3 to one chiplet. What published Linux benchmarks show, how to keep a game server on the cache chiplet, how to measure TPS and MSPT, and which to rent.
- Secure your server in the first hourA first-hour checklist: automatic updates, key-only SSH, a firewall, brute-force protection, backups and 2FA.
- Unmetered, 95th percentile or per-TB: how server bandwidth is billedUnmetered ports, 95th percentile billing, per-terabyte allowances and cloud egress fees: how each model measures your traffic, what it costs at 50 TB, 200 TB and 1 PB a month, and the questions to ask before you sign.
Protected from the first minute.
Every server ships behind always-on mitigation, with a 10 Gbps unmetered port and IPMI.
Live in ~15 minCancel anytimeBTC, ETH, XMR, USDT or SOL