All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Built My own L7 anti-DDoS system — looking for suggestions to improve it ! !
It’s an L7 HTTP/HTTPS protection layer that sits between Cloudflare and the origin server.
I originally built it for our own infrastructure, mainly to deal with HTTP floods, abusive bots, scrapers, and application-layer attacks.
Right now it includes:
Cookie / JS / interaction challenges
Automatic attack escalation + recovery
Rate limiting
Requests and Bandwidth realtime monitoring per second
Speed limiting rules per (path, extension,domain, subdomain) connection or total
Temporary bans / strike system
Managed bot/client blocklists
Lockdown mode
IP, CIDR, UA and path allowlists
Origin health monitoring
Per-domain caching
Traffic / attack visibility
Bandwidth monitoring
Webhook + email alerts
Protected subdomains
DNS stays behind Cloudflare orange-cloud, while Citadel handles filtering and proxying before traffic reaches the origin.
I’m considering turning it into a public service as well, but it’s still pretty new, so I’m sure there are bugs, edge cases, and attack patterns we haven’t run into yet.
would love to know your thoughts if you constantly deal into this
What would you expect from something like this? What would you change, and what are we missing?
If there’s interest in actually testing it, I can check with the @Mods to make it accessible
Comments
Vibe-coded?
Used AI but I used to sell Anti-DDos pre AI era as well so i know the ins and out
IDK if it can be said vibe-coded or not, you can try testing it maybe
Let me translate: "Yes its vibe coded, but trust me bro!"
does it have an ssh client?
All it takes is just vibe coded ddos executor.
I suggest to make it OSS, let us investigate what you have prompted. And after public will find few dozen of critical flaws - reboot app with different name. We already had "omni apps" from few bozzos here.
Trying to get all shit in to the forum.
First want sell a company
The vibe coded things.
Whats next?
Key Management included
"What it includes" are all user facing features, how it works under the hood?
Honestly half of the features seems un necessary, a L7 DDoS Protection alternative it's a useful product, but has to work and be performant.
Most of what you described (and more) already exists within Cloudflare free and Pro plans.
And you don't have to maintain any middleware software and hardware. They also do it on their edge anycast network, so bad traffic never hits your origin in the first place.
That's true, but fuck Cloudflare centralizing the entire internet into one big MITM. We need more diversity.
I wholly agree. It's a single point of failure
Yes I agree with this, but I'm only pointing that this solution still depends on Cloudflare
"orange state", so it just adds an extra layer of complexity without any obvious benefit.
If you put something like this behind OVH, which suck at L7, it would make more sense.
Can't you complicate it a little more? You could add a few more layers on top of each other, more external providers and even more points of failure.
Hey, add a new vibe copied ssh client, that would make it even greater.
Vibe—coded*
Yes it ssh into all servers on planet !!
less features, more breaking it. if it survives LET trying to kill it, then you’ve got a product.
Can it send mail and join IRC chats?
Haha a friend & I vibecoded a similar project recently as a fun side project. Pretty cool what LLMs can do! Ofc probably shouldn't be relied on for production, but still cool
Edit: Sorry wrong thread
“Trust me bro” is good satire but If you want proof, try to take it down, I’ll give access if it dies you can then rant about it
Right but instead of OSS I’m more interested in people trying to break the live path than reading prompts. If you find real flaws, post them. that’s more useful for me to work on it even better
Do you have any proof to back that up?
never seen a guy so obsessed, you tried to rant over the business sell
and got nuked with answers , here you trying again and will happen same, don't behave like a obsessed ex
if you are really that good then go bar to bar with knowledge
Under the hood it’s a Go reverse proxy in front of origin: challenge ladder (cookie → JS → interact), rate limits, Auto escalate/heal, allow/block lists, then pass clean traffic. CF stays orange-cloud so volumetric junk dies at the edge; This is for L7 that still gets through
Agree a lot of “feature list” is noise if the core can’t hold under load. Performance and not melting the origin are the bar
True that CF Free/Pro covers a lot. I’m not trying to replace CF as anycast. I’m trying to stop HTTP floods / bots / scrapers that still hit origin when CF alone isn’t enough for that site, especially when you want stricter challenges and per ext,path,subdomain speed limits (per connection/total)
I actually want it, would make my product better and can prove all wrong
some are just trying to oversmart just cause they learned few terms in this niche
what kinda proof you want, happy to do that as well
Which company was that done under?
eFlame hosting
https://hostadvice.com/hosting-company/eflame-hosting-reviews/#user-reviews
A user of service itself bought the business from me
Wait, are you Punjabi man?