Sucura Networks – East Coast VMs with FREE DDoS Protection + BGP – From $5.63/mo (AS398999)

MannDude · December 2025

@ehhthing said:
A little bit of a roundabout routing huh. Toronto -> New York -> Chicago -> Toronto...

 3. toro-b5-link.ip.twelve99.net                                              0.0%   225    0.6   0.9   0.5  41.6   2.7
 4. ae16.zayo.mpr1.yyz1.ca.zip.zayo.com                                       8.4%   225    0.4   0.6   0.3  15.1   1.4
 5. ae10.cr1.yyz1.ca.zip.zayo.com                                             0.0%   225   18.7  18.7  18.5  31.5   0.9
 6. ae11.mpr1.yyz1.ca.zip.zayo.com                                            0.0%   225    0.6   0.6   0.5   4.0   0.2
 7. ae25.cs1.lga5.us.eth.zayo.com                                            99.1%   225   18.8  18.9  18.8  19.1   0.3
 8. (waiting for reply)
 9. hu0-0-0-9.c1.ny2.as397423.net                                             0.0%   225   13.3  13.1  12.8  19.6   0.5
10. SucuraGuard-NYC                                                           0.0%   224   12.5  12.5  12.4  14.1   0.1
11. SucuraGuard-CHI                                                           0.0%   224   20.5  20.9  20.5  89.5   4.6
12. SucuraGuard-TOR                                                           0.0%   224   18.6  18.5  18.4  18.9   0.1

Even worse on Oxio (forgive me this is cable internet, and I'm on wifi)

 7. be7171.rcr21.yhm01.atlas.cogentco.com                                     0.0%   117   17.6  22.2  15.9  71.2   6.7
 8. be8150.ccr32.yyz02.atlas.cogentco.com                                     0.0%   117   25.4  24.3  17.0  66.2   6.5
 9. port-channel2994.ccr92.cle04.atlas.cogentco.com                           0.0%   117   25.6  27.0  21.0  45.8   4.0
10. be2718.ccr42.ord01.atlas.cogentco.com                                     0.0%   117   55.4  35.8  28.6  63.7   6.6
11. be5068.ccr32.oma02.atlas.cogentco.com                                     0.0%   117   55.5  44.4  37.0  60.5   4.7
12. be5384.ccr32.dfw01.atlas.cogentco.com                                     0.0%   117   57.9  55.3  49.9  72.3   4.2
13. be8553.rcr71.b059724-0.dfw01.atlas.cogentco.com                           0.0%   117   74.8  57.8  51.6  76.9   4.7
14. 38.120.60.42                                                              0.0%   117   59.7  57.1  48.6  74.6   4.5
15. sucuraguard-dal                                                           0.0%   117   55.4  55.3  48.5  78.5   4.3
16. sucuraguard-ash                                                           0.0%   117   71.7  69.4  62.1  78.7   3.0
17. sucuraguard-chi                                                           0.0%   117   71.7  74.8  66.3  94.0   6.2
18. sucuraguard-tor                                                           0.0%   116   67.0  72.4  66.0  95.0   5.5

We've got the same observation testing from BuyVM and RoyaleHosting NYC VMs to Sucura NYC. Should be a couple ms at most, same city, but packets go everywhere else first.

cheekydozen · December 2025

@MannDude I need all the BGP with downstream I can eat from you!!

Protocol903 · December 2025

@ehhthing said: Forgive me, but what is the point of having a DDoS protected backend if you're just gonna put Cloudflare over it. Isn't the whole point of having a DDoS protected server, not needing to use something like Cloudflare?

Even outside DDoS mitigation, Cloudflare does offer decent stuff like ASN/country-level blocking, CDNing, etc.

EricB · December 2025

@cheekydozen said:
@EricB Can you waive BGP downstream fees?

Yep — for the 2 vCPU+ plans, if you need downstream just ask and I’ll waive the fee.

EricB · December 2025

🌏 Singapore POP Now Live!

We just added our 8th location: Singapore (Asia-Pacific)

All Active POPs:

Location	Test IP	Region
🇺🇸 Chicago, IL	`142.248.30.10`	North America
🇺🇸 Dallas, TX	`142.248.30.15`	North America
🇨🇦 Toronto, ON	`142.248.30.20`	North America
🇺🇸 Seattle, WA	`142.248.30.30`	North America
🇺🇸 New York, NY	`142.248.30.40`	North America
🇺🇸 Ashburn, VA	`142.248.30.50`	North America
🇸🇬 Singapore	`142.248.30.55`	Asia-Pacific ✨
🇩🇪 Frankfurt, DE	`142.248.30.60`	Europe

Ping the closest POP | 142.248.30.1

Singapore benefits:
- Local connectivity for APAC customers
- Low latency across Asia-Pacific region
- Full DDoS protection
- VMs coming to this location in the coming months.

slideFactor · December 2025

I see quite a lot of suboptimal anycast routing on globalping. A few examples:

Scenic routing within Europe:

from Amsterdam (AS214677) to Frankfurt, via DE-CIX in Madrid (announced by GSL)
from Romania (AS9009) to Frankfurt, via London (where I think M247 has a PNI with GSL)

Routed from Europe to a different continent:

from Dublin (AS36352) to NY (I think it's your only location announcing to Zayo, and they use Zayo transit)
from London (AS16276) to NY (to DE-CIX NY, OVH almost always ends up routing traffic from their entire global network through routes learned from peering)
from France (AS208226) to Dallas (that seems to be the nearest location announcing to Cogent)
from Moscow (AS49392) to Singapore (route learned from EIE Singapore)

My 2 cents based on my experience:

in Europe and NA, you want to announce to transit only, no exchanges, because IXs have way too many large global networks or ISPs from other parts of the world which will end up preferring IX-learned routes even when they'd have much better transit routes closer to them
you want to have the same tier 1 transit providers in every location on a given continent. Use BGP communities that set a low local pref when crossing to different continents
for South-East Asia, you get better routing and speeds from Singapore IXs compared to transit
for Japan and other countries in the region (SK, Taiwan, Hong Kong), just transit from T1s with a large presence (NTT, PCCW, Lumen) is sufficient. Japan IXs are pretty well connected though, can be useful
for India and Australia, I found that announcing to T2s with communities that prevent propagation abroad was the easiest. Sydney IXs are pretty well connected for ISPs in AU and NZ though, that's also fairly viable
for South America, EdgeUno is OP. Lumen's not bad either. A Miami location is best for Central America and the north of South America, as many of the countries don't otherwise have good connections between each other
almost every time you use an IX RS, there will be a few networks you should suppress announcements to. The main one is HE. They're everywhere, and if they learn of a peering route they'll aggressively direct traffic there from anywhere in the world

Lunar · December 2025

Was late seeing this thread, hopefully I can still get double bandwidth

Order 7385157316

EricB · December 2025

@Lunar said:
Was late seeing this thread, hopefully I can still get double bandwidth

Order 7385157316

Bandwidth doubled

malhuda · December 2025

@EricB said:

🌏 Singapore POP Now Live!

We just added our 8th location: Singapore (Asia-Pacific)

All Active POPs:

Location Test IP Region

🇺🇸 Chicago, IL 142.248.30.10 North America

🇺🇸 Dallas, TX 142.248.30.15 North America

🇨🇦 Toronto, ON 142.248.30.20 North America

🇺🇸 Seattle, WA 142.248.30.30 North America

🇺🇸 New York, NY 142.248.30.40 North America

🇺🇸 Ashburn, VA 142.248.30.50 North America

🇸🇬 Singapore 142.248.30.55 Asia-Pacific ✨

🇩🇪 Frankfurt, DE 142.248.30.60 Europe

Ping the closest POP | 142.248.30.1

Singapore benefits:
- Local connectivity for APAC customers
- Low latency across Asia-Pacific region
- Full DDoS protection
- VMs coming to this location in the coming months.

Routing SG is Bad

LowEndStalker · December 2025

Gotta love someone trying to enter the DDoS prot space with less than 1Tb capacity (while claiming to be for volumetric attacks, lol) + (as far as I can tell) no application filters?

Not to mention the "Always-on scrubbing – no manual activation needed" and "Sub-second attack detection" statements. Which one is it?

EricB · December 2025

@LowEndStalker said:
Gotta love someone trying to enter the DDoS prot space with less than 1Tb capacity (while claiming to be for volumetric attacks, lol) + (as far as I can tell) no application filters?

Not to mention the "Always-on scrubbing – no manual activation needed" and "Sub-second attack detection" statements. Which one is it?

Fair questions - let me clarify:

Capacity: 900Gbps+ is our current aggregate across 8 scrubbing centers. We're transparent about being sub-1Tbps total. For most SMB/gaming workloads, it's plenty. If you're expecting 500Gbps+ sustained attacks, we're upfront that we're not Path or Voxility .

Always-on + Sub-second detection: These aren't mutually exclusive. "Always-on" means all traffic flows through scrubbing infrastructure 24/7 (not on-demand like some providers). "Sub-second detection" means our monitoring triggers active mitigation rules within ~500ms of attack traffic appearing. Both statements are accurate.

Application filters: We have L7 support for specific game protocols (FiveM, Minecraft, etc.) but it's not a full WAF. We're honest about focusing on volumetric/protocol attacks. L7 expansion is on the roadmap.

We're not claiming to compete with enterprise providers charging $5K+/mo. We're offering solid L3/L4 protection at SMB pricing for people who need it without Cloudflare. If that's not your use case, no worries.

Swiftnode · December 2025

@LowEndStalker said:
Gotta love someone trying to enter the DDoS prot space with less than 1Tb capacity (while claiming to be for volumetric attacks, lol) + (as far as I can tell) no application filters?

I think you're grossly overestimating your level of knowledge on this subject. Just because there have been recent large attacks skewing the numbers (aisuru), does not mean it's the norm.

In fact, if you read Cloudflare's latest breakdown, only 1 out of every 200,000 attacks they recorded exceeded 1Tbps.

The most common attacks are still averaging less than 100Gbps sustained.

Not to mention the "Always-on scrubbing – no manual activation needed" and "Sub-second attack detection" statements. Which one is it?

Those are not contradictory statements.

LowEndStalker · December 2025

@Swiftnode said:
Those are not contradictory statements.

It would be if they were not constantly routing through their scrubbing centers, which I presumed they were doing as they claim "Sub-second attack detection".

@Swiftnode said:
Just because there have been recent large attacks skewing the numbers (aisuru), does not mean it's the norm.

In fact, if you read Cloudflare's latest breakdown, only 1 out of every 200,000 attacks they recorded exceeded 1Tbps.

The most common attacks are still averaging less than 100Gbps sustained.

This simply isn't the case, especially because of Aisuru (and others like/related to Aisuru, e.g Kimwolf) and their ability to sell limited amounts of their botnet instead of all of it.

Botnets within the DDoS-for-hire community reach well above 100Gbps (sustained) regularly, especially for things such as game servers which usually have application-specific DDoS protection.

In fact, raw botnet DDoS-for-hire services sustain attacks in the hundreds of Gbps to low Tbps (on average). Sure, Airusu might skew the averages a bit, but its not like attacks above 1Tbps dont happen regularly. They do. The breakdown you mentioned gets diluted down heavily with all of the application specific attacks Cloudflare has been attacked with.

@Swiftnode said: I think you're grossly overestimating your level of knowledge on this subject.

Sowwy big pappy swiftnode. Kiss my ass. I don't even know why you are replying to my comment as i got the answers I wanted from Eric already.

Would you like to get further into my asshole or is that far enough?

MaxTakeba · December 2025

@malhuda said:

@EricB said:

🌏 Singapore POP Now Live!

We just added our 8th location: Singapore (Asia-Pacific)

All Active POPs:

Location Test IP Region

🇺🇸 Chicago, IL 142.248.30.10 North America

🇺🇸 Dallas, TX 142.248.30.15 North America

🇨🇦 Toronto, ON 142.248.30.20 North America

🇺🇸 Seattle, WA 142.248.30.30 North America

🇺🇸 New York, NY 142.248.30.40 North America

🇺🇸 Ashburn, VA 142.248.30.50 North America

🇸🇬 Singapore 142.248.30.55 Asia-Pacific ✨

🇩🇪 Frankfurt, DE 142.248.30.60 Europe

Ping the closest POP | 142.248.30.1

Singapore benefits:
- Local connectivity for APAC customers
- Low latency across Asia-Pacific region
- Full DDoS protection
- VMs coming to this location in the coming months.

Routing SG is Bad

Hold my coffee.

Swiftnode · December 2025

@LowEndStalker said:

It would be if they were not constantly routing through their scrubbing centers, which I presumed they were doing as they claim "Sub-second attack detection".

Even if they (Sucura) weren't constantly scrubbing at each of their edge locations, they could still be leveraging upstream carriers (like GSL) to handle volumetric attacks, providing sub-second detection/mitigation that's always on without any in-house filtering even being needed.

So even in your scenario, again, it would not be contradictory to say "always on" and "sub-second detection."

@Swiftnode said:
Just because there have been recent large attacks skewing the numbers (aisuru), does not mean it's the norm.

In fact, if you read Cloudflare's latest breakdown, only 1 out of every 200,000 attacks they recorded exceeded 1Tbps.

The most common attacks are still averaging less than 100Gbps sustained.

This simply isn't the case, especially because of Aisuru (and others like/related to Aisuru, e.g Kimwolf) and their ability to sell limited amounts of their botnet instead of all of it.

If you want to argue against Cloudflare's published data, go right ahead. I can't really refute your feelings and anecdotes.

Sustained and peak are two different metrics. A big player like aisuru can absolutely skew the numbers, and they have, but the average attack is still under <100Gbps sustained when you look at hundreds of thousands/millions of DDoS attacks. Just because you have large outliers does not mean you ignore the averages.

You have to remember that for every attack that exceeds 1Tbps, there are ~200,000 other attacks, most of which are going to be substantially smaller. (and that's just using the recorded Cloudflare data, not aggregating other big players like GSL, Voxility, Path, Datacamp/Cdn77, etc)

Botnets within the DDoS-for-hire community reach well above 100Gbps (sustained) regularly, especially for things such as game servers which usually have application specific DDoS protection.

In fact, raw botnet DDoS-for-hire services sustain attacks in the hundreds of Gbps to low Tbps (on average). Sure, Airusu might skew the averages a bit, but its not like attacks above 1Tbps dont happen regularly. They do.

The most common attack vector in 2025 was the same as it has been for the last 7-8 years, DNS.

The value those services are claiming are almost always highly inflated. Just because they spin up a website or telegram claiming to offer 5Tbps floods, the reality is often a lot different.

Again, I'm going to stick with the actual data, if you want to believe what some random stresser website/telegram claims, more power to ya.

LowEndStalker · December 2025

@Swiftnode said: Even if they (Sucura) weren't constantly scrubbing at each of their edge locations, they could still be leveraging upstream carriers (like GSL) to handle volumetric attacks, providing sub-second detection/mitigation that's always on without any in-house filtering even being needed.

Relying on upstream carriers like GSL isn't quite the silver bullet you're making it out to be. GSL's protection varies depending on the settings configured in their portal, and they're not exactly known for handling PPS based attacks well.
More importantly, that's not necessarily Sucuri's protection. that's basically outsourcing to a third party, which has its its own set of limitations and capabilities. If their "sub-second detection" depends on their upstream carrier specializing in DDoS protection and mitigating the attack, that's a bit different.

@Swiftnode said: If you want to argue against Cloudflare's published data, go right ahead. I can't really refute your feelings and anecdotes.

I'm not disputing Cloudflare's data, I'm disputing its relevance to this context. Cloudflare's dataset includes millions of small application layer attacks towards HTTP/s, AND everything else they offer (e.g Spectrum). That naturally pulls the average down significantly. Understanding what data represents isn't "feelings and anecdotes.".

@Swiftnode said: Sustained and peak are two different metrics. A big player like aisuru can absolutely skew the numbers, and they have, but the average attack is still under <100Gbps sustained when you look at hundreds of thousands/millions of DDoS attacks.

I'm aware of the distinction which is why I specifically used "sustained" in my original comment. And yes, the global average is under 100Gbps, but remember those averages are across millions of attacks to an entirely different customer base. It wont reflect the attacks Sucura faces.

@Swiftnode said: The most common attack vector in 2025 was the same as it has been for the last 7-8 years, DNS.

I don't necessarily disagree with this (especially towards non gameservers or alike), but I'm not sure how this is relevant to the discussion about attack volume/capacity. DNS amplification being a common vector doesn't contradict anything I said.

@Swiftnode said: Again, I'm going to stick with the actual data, if you want to believe what some random stresser website/telegram claims, more power to ya.

I'm not citing anything from any stresser. I'm citing real world observations made by myself. But if we're going to talk past each other, there's not much point continuing. I got the information I needed from Eric's response anyway (again, why are you responding??).

get that fist out of my ass, respectfully.

EricB · December 2025

Quick Christmas update for everyone watching this thread:

We're running a holiday sale through January 1st:
🎄 VMs: 30% OFF all small/midsize VMs (starting at $5.25/mo) - Code: XMAS30
🎄 Bigger VMs: 40% OFF on VM-4C-8G+ - Code: GOBIG40
🎄 GRE Protection: 50% OFF (100Mbps for $32.50/mo) - Code: PROTECT50

All discounts are for life, not just first month.

Full details: https://sucuranetworks.ca/#christmas-deals

Happy holidays! 🎅

fluffernutter · December 2025

was going to order a GRE tunnel but your site seems soo vibecoded i feel like even a template would have looked better

malhuda · December 2025

@EricB said:
Quick Christmas update for everyone watching this thread:

We're running a holiday sale through January 1st:
🎄 VMs: 30% OFF all small/midsize VMs (starting at $5.25/mo) - Code: XMAS30
🎄 Bigger VMs: 40% OFF on VM-4C-8G+ - Code: GOBIG40
🎄 GRE Protection: 50% OFF (100Mbps for $32.50/mo) - Code: PROTECT50

All discounts are for life, not just first month.

Full details: https://sucuranetworks.ca/#christmas-deals

Happy holidays! 🎅

Hello, can i get Trial for GRE Protection with BGP in Singapore? i tunnel from Indonesian Providers

EricB · December 2025

@malhuda said:

@EricB said:
Quick Christmas update for everyone watching this thread:

We're running a holiday sale through January 1st:
🎄 VMs: 30% OFF all small/midsize VMs (starting at $5.25/mo) - Code: XMAS30
🎄 Bigger VMs: 40% OFF on VM-4C-8G+ - Code: GOBIG40
🎄 GRE Protection: 50% OFF (100Mbps for $32.50/mo) - Code: PROTECT50

All discounts are for life, not just first month.

Full details: https://sucuranetworks.ca/#christmas-deals

Happy holidays! 🎅

Hello, can i get Trial for GRE Protection with BGP in Singapore? i tunnel from Indonesian Providers

Yes of course, please open a support ticket on https://services.sucura.ca/ or join the Discord https://discord.gg/vWt4dzsuWd and we can get you started.

douglask · December 2025

Comment Deleted

PolyAnthi · December 2025

@douglask said:
Comment Deleted

https://lowendtalk.com/discussion/137719/lowendtalk-community-rules-updated-september-2025/p1#thingswehate

If you've started a discussion or posted a comment, please do not delete the content afterward, only to replace it with messages like "delete", "delete please", or anything along those lines. If you've made a mistake, it's best to retain (and strikethrough) the original post/comment, and simply add a reason/note, e.g., "EDIT: Request fulfilled", "EDIT: Posted in the wrong thread/category", or "EDIT: Unintended double post" etc.

douglask · December 2025

@PolyAnthi said:

@douglask said:
Comment Deleted

https://lowendtalk.com/discussion/137719/lowendtalk-community-rules-updated-september-2025/p1#thingswehate

If you've started a discussion or posted a comment, please do not delete the content afterward, only to replace it with messages like "delete", "delete please", or anything along those lines. If you've made a mistake, it's best to retain (and strikethrough) the original post/comment, and simply add a reason/note, e.g., "EDIT: Request fulfilled", "EDIT: Posted in the wrong thread/category", or "EDIT: Unintended double post" etc.

Thanks for pointing out.
Will do in the future

MennoGamed · February 2

@LowEndStalker said: Relying on upstream carriers like GSL isn't quite the silver bullet you're making it out to be. GSL's protection varies depending on the settings configured in their portal, and they're not exactly known for handling PPS based attacks well.

Heh, I actually thought GSL was well suited to stop PPS attacks? Especially with their blog post about 3.15 Gpps. The only downside I see is that they don’t have Layer 7 protection. I’m actually considering connecting my network to GSL.

Howdy, Stranger!

Categories

In this Discussion

Sucura Networks – East Coast VMs with FREE DDoS Protection + BGP – From $5.63/mo (AS398999)

Comments

🌏 Singapore POP Now Live!

All Active POPs:

🌏 Singapore POP Now Live!

All Active POPs:

🌏 Singapore POP Now Live!

All Active POPs:

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Sucura Networks – East Coast VMs with FREE DDoS Protection + BGP – From $5.63/mo (AS398999)

Comments

🌏 Singapore POP Now Live!

All Active POPs:

🌏 Singapore POP Now Live!

All Active POPs:

🌏 Singapore POP Now Live!

All Active POPs: