Protection for websites, servers and networks

How it works

1. We assign a protected IP address from NetIO address space and provision your domains in the control panel.
2. You repoint DNS — an A/AAAA record, or a CNAME, to the address we gave you. Nothing changes on your server.
3. Every request is inspected at the application layer: HTTP floods, slow-rate attacks, scrapers, credential stuffing and OWASP-class exploits are blocked or challenged.
4. Clean requests reach your origin over the connection we keep open to it. Your origin address is never exposed to the public Internet.

What is included

• Protected IPv4 and IPv6 addresses assigned to your account from NetIO address space
• HTTP and HTTPS flood mitigation, including slow-rate and low-and-slow attacks
• Web application firewall covering OWASP-class threats — injection, XSS, path traversal, file inclusion
• Bot mitigation — challenge-response, JavaScript validation, TLS and HTTP fingerprinting
• Managed TLS certificates, or bring your own
• Origin cloaking, access rules, rate limits, geo and ASN filtering
• Traffic and attack analytics in the control panel, plus a documented REST API
• Multiple origins with health checks and failover

How it works

1. We assign protected IP addresses from NetIO address space — one or more per server — and agree the ports and protocols to forward.
2. A tunnel is established between our filtering node and your server using GRE or IP-in-IP; if you are in the same facility, clean traffic is delivered over a direct link instead.
3. All traffic is filtered at layers 3–4: volumetric floods, malformed and fragmented packets, amplification and state-exhaustion attacks are dropped at the edge.
4. Clean traffic arrives at your server through the tunnel, source addresses intact. Your real server address stays private.

What is included

• Protected IPv4 and IPv6 addresses assigned to each of your servers
• Any TCP or UDP service — you are not limited to HTTP
• Volumetric mitigation: SYN, UDP and ICMP floods, DNS, NTP, SSDP and Memcached amplification, IP fragmentation
• Protocol and state-exhaustion defence for firewalls, load balancers and connection tables
• Per-port and per-protocol policies, whitelists, blacklists and rate limits
• Delivery over GRE, IP-in-IP or a direct cross-connect
• Works with any operating system and any hosting provider — no software to install on your server
• Per-address traffic statistics and attack reports

How it works

1. We establish a BGP session and agree the prefixes to protect — a /24 or larger for IPv4, a /48 or larger for IPv6 — with route origin authorization in place.
2. Your prefix is announced from NetIO's network: permanently for always-on protection, or only during an attack for on-demand diversion.
3. Inbound traffic is scrubbed at our filtering nodes across layers 3 to 7, with per-prefix and per-host policies applied.
4. Clean traffic is returned to your network over GRE tunnels or a dedicated interconnect, with your original addressing preserved end to end.

What is included

• BGP session with NetIO — your prefixes remain registered to you
• Always-on protection, or on-demand diversion triggered automatically by detection
• Return path over GRE, IP-in-IP or a direct cross-connect
• Per-prefix and per-host policies, so you can tune protection for individual customers of your own
• NetFlow and sFlow based detection, thresholds and alerting
• White-label option — resell protection to your own customers under your own brand
• Protected IPv4 and IPv6 addresses from NetIO address space where you need additional capacity
• On-premises alternative: license the software and run filtering inside your own network