DDoS mitigation as a service
Intelligent DDoS Mitigation Infrastructure
Protect your infrastructure with adaptive traffic intelligence, automated attack mitigation, and reliable network defense.
For VPN providers, game server operators, hosting companies and infrastructure owners. You keep your servers, your customers and your service. UMBREN keeps attacks away from them.
How UMBREN works
Attacks stop at the edge. Your service carries on.
UMBREN places a protected address in front of infrastructure you already run. Traffic for your service arrives at a scrubbing network first, where attack traffic is filtered out. What remains is forwarded to your server.
You register a service you own
An origin address, a protocol and the ports your service listens on. UMBREN verifies that the infrastructure is yours before anything else happens.
A protected endpoint is provisioned
A protected address is reserved on an upstream scrubbing network and configured to forward to your origin. You point your users at it.
Traffic is filtered before it reaches you
Mitigation policy decides what is dropped. Legitimate traffic continues to your server; attack traffic does not.
You see what happened
Traffic, mitigation activity and incidents are reported in your dashboard and sent to your team's alert channels.
Supported network services
Built for the services attackers go after
UMBREN protects network services at the transport layer. It does not replace your service or sit between you and your customers' accounts — it defends the address your service is reached on.
VPN infrastructure
Protect tunnel endpoints, including WireGuard-compatible UDP services, without touching your subscribers or your keys.
Learn moreGaming servers
Keep latency-sensitive UDP game traffic flowing while floods are absorbed upstream.
Learn moreHosting providers
Bring many customer-facing addresses under one set of policies, roles and audit trails.
Learn moreGeneric UDP and TCP
Any single-address UDP or TCP service on a defined port range can be registered and protected.
Learn moreDDoS protection architecture
The control plane is never in the path of your traffic
Filtering happens on a scrubbing network built to absorb volume. UMBREN's control plane tells that network what to protect and how, and reads back what it saw. If our dashboard or API is unavailable, protection that is already deployed keeps running.
Filtering at the edge
High-volume traffic is handled where there is capacity for it, not in an application server.
Fails safe
A control-plane outage changes nothing upstream. Deployed protection does not depend on our website being up.
Provider-independent
Scrubbing networks connect through a common adapter contract, so the product is not tied to one vendor.
Customer infrastructure onboarding
Six deliberate steps from registration to protection
Onboarding is designed so that nothing touches infrastructure before you have proven it is yours, and nothing changes how your traffic flows until you say so.
- 01
Register
Describe the service: origin address, protocol, ports and the profile that fits it.
- 02
Verify ownership
Prove you control the origin with the verification agent or a reviewed manual request. An IP address in a form is not proof.
- 03
Validate
UMBREN checks the service against available protection capacity and your plan. Nothing is sent to your server.
- 04
Stage
A protected address is reserved upstream and your origin is configured behind it. No traffic moves yet.
- 05
Test
Once you confirm your firewall accepts clean traffic, the staged path to your origin is tested end to end.
- 06
Activate
When every check has passed, an authorized member of your team approves the change. Only then does traffic move.
Attack detection and mitigation
Six components, one mitigation policy
Each component covers one part of the problem. Every policy is versioned, can run in monitor mode before it enforces anything, and can be rolled back to any earlier version.
Packet Guard
Packet validation policy. Malformed and unwanted packets are dropped before they reach your origin.
Flood Guard
Detects UDP floods, TCP SYN floods and bandwidth or packet-rate anomalies against a learned baseline.
Flow Guard
Session-aware analysis that protects established flows while limiting abusive connection behaviour.
Protocol Guard
Protocol-aware profiles for generic UDP, generic TCP and WireGuard-compatible services.
Adaptive Defense
Learns traffic baselines, scores anomalies, and selects and escalates the mitigation policy to match.
Recovery Guard
Expires rules automatically, checks health, and rolls mitigation back safely once an attack has passed.
Network visibility
See your traffic, not a marketing number
The dashboard reports what the protection network actually measured for your endpoints: bandwidth, packet rate, protocol mix, and what was allowed versus mitigated.
- No invented data. Until telemetry is connected for an endpoint, its charts say “Awaiting telemetry” — they never show placeholder traffic.
- Attack history. Each incident records its vector, severity, peak, duration and the mitigation that was applied.
- Alerts where your team works. Email, Discord and signed webhooks, delivered with retries.
Bandwidth
Packet rate
Mitigated
Enterprise infrastructure integration
Fits the way infrastructure teams already operate
UMBREN is built to be run by a team, audited by a security function, and automated by the systems you already have.
Roles and organizations
Owner, admin, engineer, billing and read-only roles, with every organization's data isolated from every other.
Strong sign-in
Two-factor authentication, session management, and scoped API credentials that can be revoked at any time.
API and webhooks
A documented REST API for registering endpoints and managing policy, and signed webhooks for events.
Audit trail
Sensitive actions — by your team and by ours — are recorded in an append-only log you can review.
Bring your infrastructure under protection
Create an account, register an endpoint and verify ownership. Protection is activated only after every check has passed and you have authorized the change.