Anti-DDoS — block attacks up to 100 Gbps before they reach your server
BKNS scrubbing center is located in Vietnam, filtering malicious traffic before forwarding to your infrastructure. Defend against volumetric (L3/L4), protocol (SYN, UDP amp), and application layer (L7) attacks.
Latest incident · scrubbing log
- 2026-05-18 03:14:22
- ● UDP amp 18Gbps
- Mitigation start
- 03:14:34 (12s)
- Drop rate
- 99.997%
- Legit traffic loss
- 0.03%
- 2026-05-12 21:08:11
- ● SYN flood 4.2Mpps
- Mitigation start
- 21:08:19 (8s)
- Origin uptime maintained
- 100%
6-layer scrubbing pipeline — block threats from the Internet before reaching your server
All traffic from the Internet to your infrastructure must pass through the scrubbing center. Malicious traffic is dropped early; legitimate traffic is forwarded to origin with only +2ms latency overhead.
9 common DDoS attack types — BKNS blocks them all
Regardless of which layer the attack vector targets, the scrubbing center has dedicated rules for detection and mitigation.
ICMP flood
Ping flood, fragmented IP packet attacks. Rate-limit filter + ICMP drop when threshold is exceeded.
SYN flood
Exploits incomplete TCP handshake. Defended with SYN cookies and anti-spoofing whitelist.
UDP flood
UDP packets to random ports. Drop UDP if not on whitelist (DNS, NTP, gaming, etc.).
NTP / DNS / Memcached reflect
Amplifies traffic 50-500x via public services. Filters by source port + payload signature.
HTTP flood (GET/POST)
Simulates legitimate requests. Differentiated via JS challenge, fingerprinting, and behavioral scoring.
Slowloris · low-bandwidth
Keeps connections half-open to exhaust workers. Aggressive timeout + connection-rate per IP.
API abuse · credential stuffing
Brute-force login, API scraping. Detected via rate-per-session, geo, ASN, and header anomaly.
Game protocol attacks
Query flood (Source/Quake), Minecraft login flood. Defended via per-game protocol signature.
Bot scraping & carding
Bots scraping products, testing credit cards, and scraping prices. Browser fingerprint + bot management.
Capacity tiers — choose based on the attack scale you expect
BKNS has 100 Gbps total capacity, allocated per plan. Can burst to 100% of pool during a major incident.
4 plans by capacity tier
All plans are inline, always-on — no switching required during an attack. No surcharges when an attack occurs.
- Capacity 10 Gbps
- L3 + L4 protection
- SYN cookie · IP rate-limit
- 1 protected IP
- Dashboard view-only
- Email incident alerts
- Ticket support
- Capacity 50 Gbps
- L3 + L4 + basic L7
- HTTP flood + JS challenge
- Up to 3 IPs protected
- Dashboard + custom rules
- Telegram + email alerts
- Hotline during P1 attack
- Capacity 100 Gbps
- Full L3 + L4 + L7
- Game protocol awareness
- Bot management + ML behavior
- Up to 10 IPs protected
- API rules + managed WAF
- SLA 99.9% mitigation
- Capacity: by agreement
- All Shield L features
- Dedicated scrubbing path
- Custom WAF rules (OWASP top 10)
- ML bot management
- BGP anycast
- Contract SLA + RCA
Under attack right now? Emergency hotline
BKNS offers emergency mitigation — call the hotline to be routed into the scrubbing center, even if you are not yet a customer. Billed per hour, no long-term contract required.
No. BKNS Anti-DDoS works by pointing your DNS A record to the BKNS scrubbing center IP. Your origin server can be anywhere (VNPT, FPT, AWS, GCP) — BKNS simply forwards clean traffic back to you.
On average +2ms when there is no active attack. During mitigation, it may increase to +5ms due to the additional challenge step. Compared to the typical 20-50ms website access latency, this is imperceptible.
Yes — this is always-on. All traffic passes through scrubbing to guard against zero-day threats. It is not an "on-demand" model that requires activation during an attack (which takes 5-10 minutes). Always-on is better for mission-critical workloads.
No. BKNS does not charge an "attack fee" like some overseas providers. You pay a fixed fee per plan; large or small attacks are all included. Burst to 100% pool capacity when necessary.
L3/L4 (volumetric): blocks bandwidth-based attacks (SYN flood, UDP, amplification). Simple, capacity-driven. L7 (application): blocks requests that are protocol-valid but behaviorally anomalous (bot scraping, credential stuffing). Requires ML + behavioral analysis.
Shield L and above include managed WAF: OWASP top 10 (SQL injection, XSS, RFI...) and custom rules. Shield S only includes basic rate-limiting. WAF can be purchased as a standalone add-on for S/M plans.