One managed edge terminates the traffic, filters it at L3, L4 and L7, and forwards what survives to your origin. Take the parts you need, or hand us the whole edge and stop thinking about it.
Each vector below is answered by one named mechanism sitting at a specific layer. Follow a mechanism to the section that explains it.
Spoofed and malformed packets are dropped below the socket. No connection state is allocated for them, so the flood never buys itself a place in a queue.
Reflected responses arrive unsolicited. Nothing at the edge asked for them, so nothing accepts them, and the volume is absorbed away from anything you own.
Every client pays CPU before it is served. A botnet's only real advantage is that requests are cheap to send, and this is what puts a price on each one.
Concurrency, header timeouts and body read rates are capped per client. An idle socket cannot hold a worker open waiting for a request that will never finish.
Attempts are budgeted per account, per address and per session, and each attempt carries a CPU cost, so replaying a leaked password list stops being cheap.
Query strings, headers and bodies are inspected against a maintained OWASP ruleset before your application parses them. Requests are scored, not guessed at.
Probes for known paths score as anomalies and the budget runs out long before the scanner finishes enumerating. You get the log either way.
Your address is never published and the origin accepts connections only from our network, so an attacker who learns the IP still has nothing to connect to.
A client that looks wrong for its context is handed a computational puzzle instead of a verdict. Solving it costs CPU. A browser pays that once, in a moment nobody notices, and carries a token afterwards. A flood pays it on every single request, and that is the whole idea: volume stops being free, and the arithmetic that makes renting a botnet worthwhile stops working.
Difficulty tracks load. Quiet traffic is barely touched, pressure raises the price automatically, and nobody has to decide to switch something on while the site is already struggling. There is nothing for a person to read, click or identify, so accessibility and conversion are not the currency you pay security in.
A challenged request is never metered. Quota counts legitimate requests forwarded to your origin, so traffic that gets challenged, refused or dropped costs you nothing at all.
Pays once, notices nothing.
A few milliseconds of CPU inside a page that is already loading, then a token that carries the rest of the session. No image grid, no puzzle to squint at, no third party sitting in the request path deciding whether your customer is a person.
Pays again on every request.
The advantage of a botnet is that a request costs almost nothing to send. Charging CPU per request removes the advantage: the attacker runs out of budget before your origin runs out of workers, and no legitimate visitor was blocked to get there.
SYN, UDP, ICMP and amplification floods are absorbed across the network and dropped at the edge. There is nothing for you to scale up mid-incident, because the packets never arrive at a machine you pay for.
Filtering the front door achieves nothing while the back door is public. Your real address stays unpublished and the origin accepts connections only from our network, so an attacker who finds the IP still cannot open a socket to it.
Above the packet, the question is no longer whether traffic is malformed. It is whether a well formed request was meant for you.
A modern flood looks like traffic you want. A maintained OWASP ruleset, per-route rate limits and behavioural scoring separate the two, and the tuning is our work rather than a config file handed to you. Blanket blocking would cost you the customers you were trying to serve, which is the failure mode nobody reports.
A visitor is answered by the nearest location. A flood is split across the network instead of converging on one link, which is what makes volume survivable at all. The same distribution keeps latency low for the requests you actually wanted.
Automation settles the ordinary case in milliseconds. The rest is a person noticing that something is unusual, working out what it is, and telling you afterwards what happened. That work is included rather than sold back to you as a support tier.
Traffic, latency and challenge rates are sampled per site, continuously, not only as an edge-wide average that hides you inside it.
An anomaly the automation does not settle on its own reaches a person, at any hour, on the channel you nominated.
Afterwards you get a written account of what arrived, what was dropped and what changed, in a form you can forward to your own stakeholders.
If you are already under attack you are in no position to run a procurement process. We can bring you onto the network in minutes, before you are a customer, and settle the paperwork once you are back online.
Do not wait on a form. Email support@deflecto.net and say what is being hit.
The pattern repeats across every sector: the traffic that matters most arrives at the worst possible moment, and so does the attack.
Peaks are published in advance and extortion arrives on the same schedule.
A second offline is a transaction that did not settle and a customer deciding whether to trust you.
A campaign tells everyone, including an attacker, exactly when downtime would hurt most.
You signed an availability number, and Layer 7 pressure is not a clause your customers will read.
Delivery already runs near the ceiling, so a flood shows up as buffering before it shows up as downtime.
Services citizens must be able to reach, including on the day someone decides they should not.
Tell us what you run and where it hurts. You will talk to an engineer rather than a sales script, and if you are being hit right now, say that first.