DDoS Protection & Mitigation

These aim to fill your pipe. Reflection and amplification abuse open UDP services so a small spoofed request generates a huge response aimed at you, and a SYN flood exhausts the connection table on your load balancer without ever completing a handshake. The only real answer is capacity you do not own yourself: a scrubbing network with hundreds of gigabits of headroom that absorbs the flood upstream and forwards only clean traffic to your origin.

An HTTP flood looks like browsing. Thousands of requests hit your search endpoint or your cart, each one cheap for the botnet and expensive for your database. Because the packets are valid, a network-layer defence waves them through. Stopping them means understanding what normal looks like for your application and challenging what does not, which is where behavioural rules and rate limiting earn their place.

Why “just put it behind a CDN” is not a plan

A content network in front of a static marketing site helps. The same setup in front of a dynamic application with logins, checkouts and an API leaves the expensive dynamic paths exposed, and attackers know to aim there. Configuration is the whole game. We have seen sites with a well-known edge provider still go down because the origin IP was leaking in email headers and DNS history, letting the attacker skip the protection entirely.

We start by finding every reachable surface: the web properties, the APIs, the mail and DNS servers, and any origin address that can be discovered through historical DNS, TLS certificate transparency logs or misconfigured subdomains. Attackers do this reconnaissance first, so we do it first too. If your real server IP is findable, no edge protection matters.

Always-on protection keeps all traffic flowing through the scrubbing layer at all times, so mitigation is instant. On-demand routing only diverts traffic when an attack is detected, which is cheaper but adds a diversion delay of a minute or two while BGP re-routes. For a payment platform or a SaaS product with a strict SLA we usually recommend always-on for the web tier. For a large network estate, on-demand scrubbing triggered by flow monitoring can be the sensible balance. We will tell you which fits, and why.

This is where most deployments are left half-done. We baseline your normal request rates per endpoint, per country and per user-agent, then set rate limits and challenge rules that bite on abuse without tripping on your Monday-morning peak. A managed rule that blocks a genuine marketing campaign is its own kind of outage.

Because we are an offensive team, we can run a controlled load and layer-7 simulation against the protected setup, with your written authorisation, to confirm the mitigation fires and the origin stays hidden. You get evidence the defence works rather than a promise.

Edge protection only works if traffic is forced through the edge. When the origin server answers direct connections, an attacker who finds that address routes straight around your scrubbing. We check for leaks in DNS history, certificate logs, email headers and old subdomains, then lock the origin to accept traffic only from the edge network’s ranges.

The main website is behind protection; the API on api.yourdomain, the staging box, or the mail server is not. Attackers enumerate subdomains as a matter of routine. Protection has to cover the whole footprint, not just the homepage.

A single request that triggers a heavy database query, an unbounded export or a costly third-party call turns a modest flood into an outage. We flag these amplifiers during setup so the app itself is not the weapon.

We document the mitigation architecture, the detection thresholds and the results of any attack simulation, so you can hand an assessor proof rather than a marketing datasheet. When a customer’s security team sends a vendor questionnaire asking how you handle volumetric attacks, you have a real answer with numbers behind it.

If you are ever hit, you get a clear write-up: what the attack looked like, which layer it targeted, how the mitigation responded and what we changed. That record matters for insurers, for regulators and for your own board.

A default rule set is a starting point, not a finished defence. We baseline your traffic and tune the rules by hand so the mitigation fits your application, which is what separates the best DDoS protection services from a checkbox deployment. When you compare ddos protection providers, ask each one who tunes the rules and how often; with us it is a named engineer, reviewed as your traffic changes.

We work across the major edge and scrubbing platforms rather than pushing one product, so the recommendation you get is the one that fits your architecture and budget, not the one that pays the best margin.