Partner-powered · Operated by CypherMax
DDoS protection works best when it was set up before the attack. We handle the selection, the routing, the configuration and the rehearsal — so the first attack is not also the first test.
Fit
Coverage
High-bandwidth floods intended to saturate your connection — UDP amplification, reflection attacks and similar. Mitigated upstream, in the partner's scrubbing capacity, before the traffic reaches your infrastructure.
Attacks that exhaust connection state rather than bandwidth — SYN floods and their variants.
Requests that look legitimate but are designed to exhaust your application: HTTP floods, expensive search or login endpoints hit repeatedly, and credential-stuffing traffic. These are the hardest to filter without blocking real users, and the ones that need tuning against your specific application.
Scope
What is publicly reachable, what would hurt most if it went down, and which endpoints are expensive enough to be worth attacking.
Matching a partner mitigation product to your exposure, your architecture and your budget. An always-on scrubbing service and an on-demand one are different commercial and operational commitments, and the right choice depends on how often you expect trouble.
Routing or DNS changes, protected-endpoint configuration, origin hardening so your real IP addresses are not trivially discoverable, and rate limiting on the endpoints that need it.
Layer 7 rules tuned against your actual traffic, so legitimate users are not caught in the filter. This takes iteration, and it is work, not a switch.
A written procedure for what happens during an attack — who is notified, who has authority to change rules, what the escalation path into the partner looks like. Agreed while everyone is calm.
Ongoing monitoring, with response inside the agreed scope when something starts.
A written summary after any significant event: what happened, what was mitigated, what should change.
Platforms
We provision mitigation services from the cloud platforms we collaborate with: Amazon Web Services, Google Cloud, Alibaba Cloud, Tencent Cloud, Huawei Cloud and BytePlus.
FAQ
No, and neither can anyone else honestly. What we can do is put mitigation capacity in front of you, tune it to your application, rehearse the response, and give you a clear picture of what is and is not covered.
A CDN absorbs some categories of attack and none of others. The two services overlap but are not substitutes, and if you run both they need to be configured together — see CDN.
It depends on the product and on whether routing changes are needed. Onboarding during an active attack is possible but always worse than onboarding before one.
Badly tuned Layer 7 rules will. That is why tuning is an explicit part of the service rather than a one-off setup task, and why we monitor false-positive signals after go-live.
It depends on the product, the protected bandwidth, and whether you need always-on or on-demand mitigation. We will quote a specific figure after the exposure review rather than a range now.
Related