Volumetric
- TCP flood (ACK, PSH, SYN, RST, URG)
- UDP flood
- ICMP flood
- GTP and ESP flood
- Ping of Death
- Teardrop and reflected
Protection
Attacks stop before they reach you.
Every Loafhosts server, game or bare metal, sits behind Terabit DDoS Protection. It is on from the first minute, it is not an add-on, and it costs nothing extra. Wipe day, raid night, a 100-player milsim op, the filtering does not care.
Protection on every plan
500+ Gbps
Mitigation
Always on
24/7/365
Coverage
Every region
Every plan
Included
Game and bare metal
$0
Add-on cost
Never an upsell
On from the first minute, on every server
See it working
Watch a flood hit the filter.
This is the real Terabit mitigation visualisation. Turn the filtering off and watch the attack traffic reach the origin. Turn it back on and watch it stop.
Desktop required
The mitigation visualisation renders in WebGL and needs a larger screen to show the traffic flow properly. Open this page on a desktop or laptop and it runs right here in the page.
The short version: attack traffic is absorbed at the edge, game-aware rules drop what is left, and only real player traffic reaches your server.
How it works
Four stages, none of them on your node.
Filtering happens upstream. By the time traffic reaches your server it has already been through every stage below.
01
Anycast ingress
Traffic enters at the closest edge instead of a single choke point, so a flood is split geographically before anything is filtered.
02
Volumetric scrubbing
L3 and L4 floods are absorbed at edge capacity. The bulk of any attack dies here, off your node entirely.
03
Stateful filtering
What survives meets protocol-aware and game-aware rules that understand what a real join looks like and what a forged one looks like.
04
Clean traffic
Only validated traffic reaches your server. Your players stay connected and your tick rate does not move.
Threat coverage
What it actually stops.
Volumetric floods are the easy half. The half that breaks game servers is protocol abuse that looks almost exactly like a real player.
Reflection and amplification
- DNS amplification
- NTP amplification
- SSDP and UPnP
- Memcached
- QUIC
- Chargen, SNMP, LDAP, RIP, TFTP
Resource exhaustion
- Malformed and truncated packets
- IP fragmentation
- Invalid TCP flag attacks
- Bad checksums
- Bogus TCP and UDP flags
- Reserved IP addresses
Gaming
- A2S source flood
- A2S GETSUM
- FiveM exhaustion
- Handshake abuse
- HTTP Slowloris
- NetBIOS
Protection tiers
Every tier is protected. Pick what you need on top.
Basic is not a lesser filter. The filtering is the same, and the higher tiers add an IP that is yours alone and our hardest rule profile.
Basic Protection
IncludedTerabit DDoS Protection, on every shared region.
- 500+ Gbps of Terabit DDoS Protection
- Built for Arma Reforger traffic
- Shared IP address
Dedicated IP
+$7The same Terabit filtering, on an IP address that is yours alone.
- Everything in Basic
- Dedicated IP address
- Shared regions
Strict Protection
+$12Our hardest filtering, from the Montreal fleet.
- Everything in Dedicated IP
- Hardest L4/L7 filtering profile
- Montreal only
Tier prices are per month and shown live in the builder as you configure.
Rolling out
What lands next.
Loafhosts is now owned by Terabit.io, and the protection stack is getting deeper because of it. These are on the way, not shipped yet.
Firewall manager
SoonAllow and deny rules per protocol and per country, plus mitigation profiles applied to individual ports.
Real-time attack alerts
SoonWebhook and email notifications the moment an attack starts and when it clears, so you hear it from us first.
Terabit bare metal
SoonLoafhosts infrastructure is moving onto Terabit-owned hardware, starting with our US and EU locations.
Stay online
Protected from the first minute.
You do not configure it, you do not pay extra for it, and you do not wait for an attack to find out whether it works.
Included on every plan · No setup fees · Cancel any time