Edgium / DDoS Protection
DDoS protection: the attack is split across the network and stops at the edge
Every point on the Edgium network, in Brazil and abroad, announces the same IPs. A distributed attack arrives split across them, each point filters its share, and your server receives only real traffic.
Why an anycast network holds up under attack
On a single server, the whole attack lands in one place. On an anycast network, routing takes each visitor, and each attacking machine, to the nearest point. The volume spreads out, and filtering happens before anything reaches you.
- visitor request
- response delivered by the edge
- fetch from your origin
- attack blocked at the edge
Swipe sideways to see the whole animation.
The volume is split
Each point receives only the share of the attack coming from its region, and filters it there. None of your servers receives the full volume.
The origin stays hidden
Your server's IP does not appear in DNS. Attackers find the Edgium network, and the origin can accept only Edgium and close itself off from the rest of the internet.
A point goes down, traffic keeps flowing
If a point goes offline, BGP sends traffic to the next one, which has the same IP. No DNS change and no waiting for TTL.
What gets protected
DDoS protection comes with every product, because they all run on the same network. You choose what to put behind the edge.
Site, online store and API
Through the CDN and WAF: the web application firewall blocks SQL injection and other common attacks, blocks by country, IP, host and user-agent, and challenges bots and suspicious traffic before it reaches the application.
Internet provider DNS
Through DNS Firewall: random subdomain floods, mass NXDOMAIN, empty queries and ANY stop at the edge, with per-second limits tuned to your network.
DNS zones
In managed DNS and DNS Slave: the same protection as DNS Firewall, built into the zones that answer through the anycast network.
Email, telephony and databases
Through the Load Balancer: SMTP, SIP, MySQL and SQL Server go through the edge over TCP and UDP, without exposing your servers' IPs.
Where each type of attack stops
| Attack | Where it stops | What happens |
|---|---|---|
| Traffic flood | At the edge, split across points | Each point filters its share, and the origin does not receive the volume |
| HTTP request flood | At the WAF | Challenge for bots and suspicious traffic, blocking by country, IP and user-agent |
| SQL injection and web attacks | At the WAF | Rules against common web attacks, before they reach the application |
| Random subdomain and NXDOMAIN | At DNS Firewall | Dedicated per-second limits, separate from normal traffic |
| ANY query (amplification) | At DNS Firewall | Refused, so your DNS is no longer used against third parties |
| SYN flood (TCP) | At the edge | Fake connections stop before they reach your server |
| DNS hijacking and poisoning | At managed DNS | DNSSEC and blocking of hijacking and poisoning |
| Direct attack on the server IP | It does not get through | The origin IP stays hidden, and it can accept only Edgium |
What changes for your company and your visitors
For your company
- Site up during the attack: bad traffic stays at the edge and good traffic keeps flowing.
- A right-sized server: the origin does not need to be sized for the worst day.
- Onboarding without migration: your DNS stays where it is, and going back means undoing one record.
- People watching: our team sets it up and watches the traffic with you, in Portuguese.
For your visitors
- Pages that open, even while someone is trying to take the site down.
- Nearby responses, from the closest network point, in Brazil or abroad.
- No strange address: the same domain and the same padlock as always.
Use cases
Common situations and how Edgium handles each one.
Online stores and e-commerce
Black Friday without slow pages: edge cache, WAF against bots and DDoS protection at the peak.
See the full exampleInternet provider (ISP) and hosting
DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge.
See the full exampleVoIP telephony and SIP exchanges
A SIP exchange out of the line of fire: hidden IP, attack stopped at the edge and more than one server behind it.
See the full exampleQuestions about DDoS protection
What is a DDoS attack?
It is a distributed denial-of-service attack: many machines, from many places, send traffic or requests at the same time to take down a site, an API or a DNS server.
How does an anycast network help against DDoS?
Every Edgium point, in Brazil and abroad, announces the same IPs. The attack arrives split across them, each point filters its share, and none of your servers receives the full volume.
Do I need to move my DNS to Edgium?
No. Your DNS stays where it is. To protect a site, you only change its records to point to Edgium, including on the root domain, with plain A and AAAA records.
Can I test the protection before signing up?
Yes. Talk to us: Edgium sets up a trial with a subdomain, an application or a zone, and you follow it with your own traffic before moving the rest.
I am already under attack. Can you help?
Message us on WhatsApp and tell us the domain, service or IP being attacked. We work with you on the fastest way to put the service behind the edge.
Talk to Edgium and test the protection
Tell us what you need to protect and whether you have been attacked before. We set up a trial with a subdomain, an application or a zone, and follow it with you.