VPSbitDDoS filtering: L3/L4 vs L7
Where included scrubbing stops and your application begins: volumetric drops at the edge, HTTP-layer floods on your stack, BYOIP on the top metal tiers.
Volumetric floods die at the edge on every SKU, included in the price; HTTP-shaped L7 abuse still belongs to your application stack. Bringing your own IP ranges is a Monolith- and Monolith-tier arrangement with LOA and ASN.
12 locations · 19 coins · SLA 99.95% · no KYC · public canary
Always on
L3/L4 scrubbing runs on every VPS and dedicated SKU with no second invoice attached — the edge absorbs floods on the order of a 1 Tbps-class capacity before they touch your plan's port. Because filtering is a platform property rather than a per-IP product, an attacker cannot buy your way out of protection or aim at an unprotected address you own.
VPS from $4.80* — Core on the annual term (list $6/mo), one invoice for 12 months, no auto-charges. Dedicated with IPMI from $39.20/mo. Crypto invoice, no KYC.
Launch nowL7 is different
Application-layer floods disguise themselves as ordinary HTTP and pass right through a stateless edge — draining connection pools and databases is your stack's war. Optional L7 assistance exists for HTTP workloads, with a hard limit: it is a mitigation service, never cover for AUP violations; the policy travels with the traffic it filters.
IP and BYOIP
Every VPS ships 1x IPv4 plus a /64 with editable PTR. Bringing your own ranges is a dedicated-tier feature — Monolith and Monolith — arranged with a LOA and ASN and a few days of lead time, after which your announcements originate from the same filtered edge. Published looking-glass endpoints give indicative RTT per flag before you order.
Is DDoS protection an upsell?
No — it is inside the base price of every SKU, VPS and dedicated alike, which is why the ranking pages score providers on that fact.
When does a null-route happen?
Only as the last resort: if a workload is actively violating the AUP and its operator ignores the ticket, the address gets pulled. Legitimate targets under attack keep their IP.
Can the filter read my game or app protocol?
No — L3/L4 works below the application layer. Traffic-shaped abuse that looks like real players or real HTTP needs your own plugins, panel rules or an L7 proxy.
Primary sources
Ready to launch?
Build the box — VPS or bare metal — create the password, pay the invoice that follows.