Itnetic TechnologiesEmergency onboarding
Under DDoS attack right now?
Get your site back. Create an account, add your domain and change two DNS records — most people are filtering attack traffic in about five minutes. The free plan includes the full protection, needs no credit card and has no contract to sign while you are panicking.
- ~5 minfrom signup to filtering, on a low DNS TTL
- 2 recordsone TXT proof, one CNAME. Nothing on your server changes
- €0free plan, every feature, no card
What to do now
Four steps. None of them touch your server.
You do not install anything, you do not move your site, and you do not change a line of code. Your origin stays exactly where it is — traffic just stops arriving there directly.
- 01
Create an account
Email and a password. The free plan carries the same mitigation, WAF, rate limits and logs as every paid plan — no card, no sales call, no trial clock.
- 02
Add your domain
Type the hostname that is being attacked and where it should point — your current server address. Subdomains work on their own; you do not need to move your whole zone.
- 03
Publish two DNS records
A TXT record that proves the domain is yours, and a CNAME that sends traffic to us instead of straight to your server. Both are shown ready to copy at your registrar.
- 04
Watch it get filtered
As soon as the record resolves, requests arrive at our edge first. Attack traffic is challenged or blocked; real visitors are served. Every decision lands in your per-request logs with the reason behind it.
The DNS change
This is the whole change.
Two records at your registrar, filled in for your domain in the dashboard. Nothing else in your zone moves.
Apex domains
On a bare apex (example.com with no subdomain) a CNAME is not legal DNS. Most registrars offer ALIAS, ANAME or CNAME flattening for exactly this case, and the dashboard names whichever yours supports — or hands you A records to use instead.
While DNS propagates
Three things worth doing in the next ten minutes.
These are worth doing whoever you end up buying mitigation from. The first one is the difference between five minutes and several hours.
- 01
Drop your DNS TTL first
Your record’s TTL is how long resolvers keep serving the old answer. Set it low before you change anything else — a record still cached for an hour is an hour of attack traffic that never sees us, and no provider on earth can shorten it for you.
- 02
Stop your server answering anyone but us
An attacker who already knows your server’s IP address can keep hitting it directly and walk straight past any proxy. Firewall your origin so it only accepts connections from our edge — the dashboard lists the addresses. If the address is already public and being flooded, ask your host for a new one.
- 03
Do not pay a ransom demand
If an email arrived demanding payment to stop the attack, paying marks you as someone who pays and buys nothing enforceable. Keep the message as evidence, keep your logs, and report it — our guide walks through telling a bulk bluff from a credible threat.
What actually stops
The two halves of an attack, handled in two different places.
Most "under attack" pages blur these together. They are not the same problem and they are not solved in the same place.
The flood that fills your uplink
Raw volumetric floods are absorbed upstream of our edge, where they belong: Frankfurt and Beauharnois sit behind X4B, a network with 500 Gbps of capacity, and Singapore runs on OVHcloud with OVHcloud’s own network-level protection. That traffic never reaches your server’s uplink to fill it.
The requests that look like customers
The harder half is the flood that is shaped like real browsing — real headers, real TLS, real pages. Ours is measured against what normal looks like for your site rather than a threshold in a config file, so a busy Monday is not an attack and a quiet site under attack is not ignored.
Visitors are not punished for it
Real people are not shown a CAPTCHA to prove they are real. A request we are unsure about is asked to do work a browser does invisibly and a botnet cannot afford at scale.
The attack does not spend your bandwidth
Traffic we mitigate is not metered against your plan’s bandwidth. An attack cannot run up your bill or push you over a quota — the point of buying protection is not to be charged for being attacked.
You can see every decision
Per-request logs show the verdict on each request and the reason for it, and the attack timeline shows the shape of the incident minute by minute. That is what you send to your boss, your customers or your insurer afterwards.
A queue instead of a crash
If the real demand alone is more than your server can hold, a waiting room admits visitors at a rate your origin survives and shows everyone else their place in line, instead of letting the whole site fall over.
Being straight with you
Two things nobody can make instant. DNS is the first. Traffic moves to us as resolvers expire the old record, so the switch is as fast as the TTL you had set before the attack started — minutes on a low TTL, potentially hours on a high one. The second is your server’s own address: if an attacker already has it, they can keep hitting it directly until you firewall the origin to our edge or your host gives you a new address. Both are on the checklist above because they are the two places where a fast recovery is actually decided.
Is this even an attack?
Telling a DDoS from a bad afternoon.
Looks like an attack
- Traffic jumped many times over in minutes with no campaign, launch or press behind it
- Requests concentrate on a handful of expensive paths — search, login, checkout, an API endpoint
- The origin is at full CPU or connection limit while the pages themselves have not changed
- Visitor countries or networks look nothing like your usual audience
- An email arrived demanding payment to make it stop
- It stops and restarts in waves, rather than tailing off like real demand
Probably not an attack
- A single slow query or a stuck deploy — traffic is normal, the site is not
- Genuine demand from a launch, a sale or a post that took off
- A crawler or scraper being impolite: high volume, but steady and identifiable
- An upstream provider incident — check your host’s and our status page first
- An expired certificate or DNS misconfiguration, which looks like downtime and is not traffic at all
Either way
Either way the fix costs the same here: put the edge in front, then read the logs. If it turns out not to be an attack, the logs tell you that within a minute — and you keep the caching and the WAF.
Pricing
The protection is the same on every plan, free included.
Plans differ by how many domains you protect and how much delivered bandwidth is included. Mitigated attack traffic is not counted against it.
Asked during incidents
The questions people ask at 3am.
How fast can I actually be protected?
Signup, adding the domain and copying two records takes a few minutes. After that it is entirely down to your DNS TTL: traffic shifts to us as resolvers expire the record they cached before you changed it. On a low TTL that is minutes. On a TTL of an hour or a day, it is that long for the last stragglers — which is why lowering it is the first thing on our checklist.
Do I have to move my website?
No. Your site stays on the server it is on now and nothing about it changes. The only change is where your domain points, so requests reach our edge first and only clean ones are passed on to you.
Will my visitors see a CAPTCHA?
No. Real visitors are never asked to identify traffic lights. When a request is unclear, the browser is asked to do a small piece of work in the background that a person never notices and a botnet cannot pay for across millions of connections.
What does the free plan leave out?
No feature. Mitigation, WAF, rate limiting, the waiting room, per-request logs, analytics and the API are on every plan including the free one. Plans differ by how many domains you can protect and how much delivered bandwidth is included — and attack traffic is never counted against that.
Do I need to pay right now to get protected?
No card is required to sign up and start filtering. If the attack takes you past the free plan’s delivered bandwidth you can upgrade at that point — but the mitigated traffic itself is not metered, so an attack alone does not force an upgrade.
My HTTPS certificate — do I need to do anything?
No. A certificate for the hostname is issued automatically once the record points at us, and renewed automatically after that. You can also upload your own if you already have one.
The attacker knows my server’s IP address. Does this still work?
Yes, but only once you close the direct route. Put a firewall rule on your origin that accepts connections from our edge addresses and nothing else — the dashboard lists them. Until you do, an attacker with the old address can bypass any proxy, ours included, and that is true of every provider.
Is a Minecraft or game server the same process?
Same idea, different page. Game servers are attacked through joins, pings and connection floods rather than HTTP requests, and are protected by a filtering relay in front of the server with no plugin or mod involved.
Go deeper
While you wait for DNS
Plain-English reading on what is happening to you and what to do about it.
Two DNS records and the attack stops being your problem.
Free plan, every feature, no card and no contract. If you get stuck at any step, the Discord is the fastest way to reach a human.