VibeSHIELD is our globally anycasted DDoS-protection network. Customer traffic is announced from every PoP simultaneously and routed to the closest scrubbing location for filtering, so attack traffic never reaches your server. Multi-Tbps total mitigation capacity, always on.

Which games are supported with custom filters?

FiveM, RAGE:MP, Rust, DayZ, The Isle, Arma 3, Arma Reforger, SCUM, Counter-Strike 2, Counter-Strike 1.6, Team Fortress 2, SAMP, TeamSpeak, Garry's Mod, Call of Duty 2, Conquer, Lineage 2 and more. Each filter is tuned to the protocol's quirks (UDP fragmentation, query-amplification, spoofed-handshake floods) so legitimate players keep playing during an attack.

Is VibeSHIELD included with hosting plans?

Yes. Every game server, VPS, dedicated server and bare metal machine sits behind VibeSHIELD by default. There is no extra subscription, no per-Gbps charge, no traffic surcharge.

Where are your scrubbing locations?

We operate 46 PoPs across North America, Europe, Asia-Pacific, Latin America and the Middle East / Africa. Traffic enters at the nearest PoP to its source, gets filtered there, and only clean traffic continues on to your server.

Can I see attacks happening to my server?

Yes. The dashboard shows real-time mitigation events for every service (packet rate, attack vector, source ASN) so you can see exactly when and how your server is being targeted.

Does VibeSHIELD add latency?

No. Anycast routing sends every visitor to the PoP closest to them, where filtering happens inline on the same path their traffic was already taking. There's no extra hop to a faraway scrubbing centre and no measurable added latency.

VibeSHIELD

Every VibeGAMES server sits behind 46 anycast scrubbing locations in 5 regions, with filters written per game protocol. Attacks are dropped at the edge they enter. Players never notice.

Included with every server

46 anycast locations

17 game profiles

No added latency

Browse protected servers See the network

Attacks stopped, last 30 days

3,673

Largest

4.4 Tbps

Oct 12Peak day Nov 1: 435 attackstoday

Lighter bars: a day with an attack of 3.0 Tbps or more.

Scrubbing locations: 46; Anycast PoPs in 5 regions
Game-aware filters: 17; Custom filters per game protocol
Typical attack: 1 m 32 s; Median duration. Nine in ten are over within 6 minutes.
Added latency: 0 ms; Filtering is inline, no detour

How it works

The path of a packet

Four hops between a botnet and your players. Only the last one reaches your server.

No DNS tricks, no client configuration

FiveM profile

Attack trafficPlayer traffic

Attack enters
A botnet aims a flood at your server's address. Most of what we see is UDP, line rate, at the game port.
Nearest of 46 PoPs
Anycast routing hands every source to its closest scrubbing location. The flood never crosses an ocean.
Game-aware filter
One of 17 game profiles knows what a real FiveM, Rust or Arma packet looks like. Everything else is dropped.
Your server
Only player traffic arrives, on the normal port, at full speed. An email tells you it happened.

On the wire

What hit us lately

Anonymised, straight from the attack log. The target is the game behind the attacked port.

Last 24 hours, refreshes hourly

Time	Target	Vector	Peak	Duration	Result
13:30	FiveM server	UDP + TCP flood	34.7 Gbps	3 m 49 s	Dropped
13:29	FiveM server	UDP + TCP flood	2.6 Gbps	1 m	Dropped
13:29	FiveM server	UDP + TCP flood	213 Gbps	1 m 09 s	Dropped
13:20	Minecraft Bedrock server	UDP + TCP flood	380 Mbps	8 s	Dropped
13:19	FiveM server	TCP + UDP flood	367 Gbps	3 m 34 s	Dropped
13:13	Minecraft Bedrock server	UDP + TCP flood	1.2 Gbps	1 m 09 s	Dropped

Network

Where attacks come from, and where they stop

Every address is announced from all 46 scrubbing locations at once, so a flood is filtered at the PoP nearest to its source. The shading shows where this month's attack traffic originated.

46 PoPs in 5 regions, every IP announced from every PoP

Pick a region for its locations.

Active scrubbing PoPLighter: more attack traffic came from there

Attack traffic by origin, last 30 days

Share of the summed attack peaks by source country. Botnets rent devices everywhere, so the list is about volume, not blame.

Brazil29%
Argentina9%
Mexico7%
United States6%
Chile5%
Malaysia4%

Compare

How VibeSHIELD compares

Most hosts buy generic scrubbing and call it DDoS protection. The difference shows the first time a 100 Gbps flood pretends to be your players.

	VibeSHIELD	Typical game host	Unprotected server
Included in the price	Every server, no add-on	Often a paid tier or a size cap	You are the mitigation
Filters written per game protocol	17+ game profiles	Generic L3/L4 scrubbing	None
Filtered at the nearest location	46 anycast PoPs	One or two scrubbing centres	Traffic lands on the server
Attack history per server	Size, timing and a full breakdown in the dashboard	Rarely, usually on request	A player count that drops to zero
You hear about it	An email per attack, no action needed	Sometimes, after the fact	From your players
Added latency	None, filtering is inline	A detour to the scrubbing centre	Not the problem anymore

Dropped

Attacks we drop

A non-exhaustive list. If it has been seen on the wire, there is a filter for it.

From the breakdown we store for every attack. Updates hourly.

Volumetric floods

Raw bandwidth, meant to fill the pipe before the server sees a packet.

UDP floods
Line-rate junk at the game port, the bulk of what we see.
UDP fragmentation
Oversized datagrams the server would have to reassemble.
Spoofed SYN
Half-open connections from forged addresses.
GRE and tunnel floods
Encapsulated traffic that generic filters wave through.
ICMP floods
Ping storms and oversized echo requests.

Reflection and amplification

Small forged requests to open servers on the internet, large replies aimed at you.

DNS and NTP
The classics, still in most large attacks.
SSDP / UPnP and CLDAP
Home routers and directory servers as amplifiers.
Memcached, CoAP, SNMP
Up to 50,000 times amplification per request.
WS-Discovery, SIP, Portmap
Whatever answers from a forged source that week.

TCP state and application

Fewer packets, aimed at connection tables and web endpoints.

TCP state exhaustion
Connections opened and never used, until the table is full.
TCP fake open
Handshakes that look complete and never carry data.
Slowloris
Requests that trickle in to hold a worker hostage.
HTTP GET/POST floods
txAdmin, web panels and APIs behind your server.
HOIC, LOIC and XOR DDoS
Off-the-shelf tools and botnets, recognised by signature.

Game protocol abuse

Traffic shaped like your game, which is where generic scrubbing gives up.

Query floods
A2S, RakNet ping and server-list queries, answered at the edge.
Fake handshakes
FiveM, Source and RakNet joins that never become players.
RCON and BattlEye hammering
Admin ports kept out of reach of the flood.
Custom protocol abuse
Anything new gets a filter once it is seen on the wire.

Seen on our network, last 30 days

Protocols, share of attacks

UDP90%
TCP65%
ICMP39%
IPv6-ICMP5%

Reflection vectors, attacks they appeared in

DNS546
CoAP71
SSDP / UPnP69
NTP64
SNMP54
WS-Discovery46
SIP39
Portmap38

Show your players you're protected

A badge for your Discord, your community site or your server listing. The counter inside it is live and updates on its own every hour. Right now it reads 3,673 attacks stopped in the last 30 days.

Protected by VibeSHIELD, VibeGAMES DDoS protection

HTML

<a href="https://vibegames.com/vibeshield?utm_source=badge&utm_medium=embed"><img src="https://vibegames.com/api/vibeshield/badge" alt="Protected by VibeSHIELD, VibeGAMES DDoS protection" height="56"></a>

Markdown

[![Protected by VibeSHIELD, VibeGAMES DDoS protection](https://vibegames.com/api/vibeshield/badge)](https://vibegames.com/vibeshield?utm_source=badge&utm_medium=embed)

BBCode

[url=https://vibegames.com/vibeshield?utm_source=badge&utm_medium=embed][img]https://vibegames.com/api/vibeshield/badge[/img][/url]