DDoS
Our protection runs on Andrisoft’s award-winning Wanguard platform. It is the same software carriers and hosting providers run on their own metal, deployed inside our network rather than rented from a third party — which is why mitigation happens where your traffic already is.
Watches the live traffic on our edge and learns what normal looks like for each address, measuring over 130 traffic metrics against per-IP thresholds. An anomaly is flagged on its own shape, not on a signature list.
130+ traffic metrics per address
Takes the flagged traffic apart and writes the rules that isolate the attack, so malicious packets are dropped while legitimate ones keep flowing to the same IP.
The reporting core the two feed into — where an attack's vector, peak and duration come from, and the same record you see in your panel.
01
Sensor sees the destination step outside its own baseline and raises the anomaly.
02
Filter builds rules for that specific vector. Traffic to the address keeps flowing; the attack does not.
03
Vector, peak Gbps and packets per second land on the attack history for that IP.
04
A prefix is blackholed as a last resort, and you can see and lift it yourself from the panel.
On-net filtering handles what our own edge can absorb, and it is on every address from the moment it is announced. Advanced is our premium tier, and it adds Arelion in front of it: mitigation on a tier-one backbone, so an attack larger than a single metro can carry is dropped before it reaches us. The on-net filtering stays on underneath it.
It is sized rather than sold in fixed tiers, because the thing that varies between two customers on the same chassis is not the chassis — it is how much legitimate traffic has to keep flowing, and how big the attack in front of it gets.
Game, VPN, voice, web or enterprise. The workload decides which application filters the profile is built from, and what it costs — game and VPN traffic need per-protocol rules rather than a volumetric drop.
The legitimate bandwidth we commit to deliver through a mitigation, from 1 to 20 Gbps. Scrubbing that drops your players along with the flood is not mitigation.
The largest attack you expect to absorb, up to 4 Tbps. Capacity is reserved in bands, so this is priced in bands rather than by the gigabit.
Monthly, per server, on top of the plan. Every number below is the one the order page charges — pick the three answers there and the total is worked out in front of you.
| Up to 100 Gbps | Included |
| 101–500 Gbps | +$60/mo |
| 501 Gbps – 1 Tbps | +$150/mo |
| 1–2 Tbps | +$260/mo |
| 2–4 Tbps | +$400/mo |
| Web / general hosting | Base rate |
| Voice / streaming | × 1.1 |
| VPN / proxy | × 1.15 |
| Game server | × 1.25 |
| Enterprise / custom | × 1.3 |
Tailored profile
$95/mo
Building and tuning the profile, including the first 1 Gbps of clean traffic.
Additional clean traffic
$35/Gbps/mo
Above the first 1 Gbps, to 20 Gbps.
The workload multiplier applies to the whole monthly, and the total is rounded to the dollar. Worked through, that comes out as:
| Example | Clean traffic | Attack absorbed | Per month |
|---|---|---|---|
| Small site Web / general hosting | 1 Gbps | 100 Gbps | $95 |
| Busy game server Game server | 5 Gbps | 500 Gbps | $369 |
| VPN endpoint VPN / proxy | 10 Gbps | 1 Tbps | $644 |
| Enterprise edge Enterprise / custom | 20 Gbps | 4 Tbps | $1,508 |
Generic volumetric filtering keeps a server reachable. A profile keeps it playable: it knows which protocol and ports the application really uses, so a flood dressed up as legitimate traffic still gets dropped. Set one per IP, change it whenever you like.
Handshake and login checks. Drops bot-join floods, null pings, and status storms.
25565
RakNet-aware filter for Bedrock query and connect floods.
19132
Source / CS2 filter. Rate-limits A2S queries and malformed game packets.
27015
FXServer connect and query filter. Holds the game port under UDP floods.
30120
Rust, Unturned, and other RakNet titles. Challenges preauth floods.
Keeps handshake packets while dropping junk UDP aimed at the tunnel.
51820
Validates OpenVPN opcodes so the concentrator stays up under flood.
1194
SYN and ACK flood control for public websites. Passes legitimate TLS.
80, 443
Web plus WHM/cPanel ports. Stops random-port scans from filling the NIC.
80, 443, 2083, 2087
Drops amplification and ANY floods. Allows real resolvers through.
53
Always-on volumetric filter. Active when no application profile is selected.
Per-IP UDP and ICMP thresholds, minimum attack size, port scope, and IP allowlists — editable from the panel without opening a ticket.
Every mitigation is on the record: which vector, how big it got, how long it ran, and whether anything was null-routed.
Filtering is part of the price, on every address, with no proxy in front of it. Nothing about staying online is gated behind a ticket or an upsell — Advanced adds upstream capacity, it does not switch protection on.
Pick a chassis and a location — the protection is already on.
