DDoS protection for hosting providers: one customer under attack should not become everyone's problem.
Hosting environments are high-value targets by design. You concentrate infrastructure that attackers want to disrupt, and your responsibility extends across every tenant on your platform. RioRey gives you the tools to isolate, mitigate, and recover without collateral damage.
The challenges you face
-
Shared infrastructure risk
A single attacked tenant floods shared uplinks
Without per-destination mitigation, one customer's attack becomes every customer's outage. The collateral damage is unavoidable unless traffic is filtered before it reaches shared infrastructure.
-
Operational scale
You cannot respond manually to every attack
Hosting environments absorb attacks constantly. A protection system that requires engineer intervention for each event is not viable at the scale you operate. Automation is not optional, it is fundamental.
-
The baseline problem
Normal traffic is always changing
Customers join and leave continuously. Traffic patterns shift with every provisioning change. Anomaly-based detection that relies on a stable baseline fails in this environment. You need detection that works from day one, with no learning period.
How RioRey fits your operation
-
Per-destination isolation keeps your other tenants clean.
RioRey identifies attack traffic by destination IP and mitigates it independently. An attack targeting one customer's address does not affect traffic destined for anyone else on your platform. Neighbors stay clean automatically.
-
No baseline required. Protection starts immediately.
RIOS analytics are built on attack methodology, not traffic history, and cover all 25 classes of the RioRey Taxonomy of DDoS Attacks. When you provision a new customer, their traffic is protected without any learning period or tuning. This is critical in environments where new workloads appear constantly.
-
Give customers visibility into their own protection.
The rWeb customer portal lets each tenant see their own traffic data, attack history, and mitigation events. That transparency removes support burden from your team and becomes a differentiator you can use in sales. Customers who can see their protection are customers who trust it.
-
Scale filtering as your platform grows.
There is no single-device ceiling. RIOS filtering runs identically across hardware appliances and rVM virtual instances. As your customer base grows, you add filtering capacity by running additional instances in parallel. The architecture scales with your business rather than forcing you to size for a worst-case scenario upfront.
Recommended deployment paths
-
Most common for hosting providers
In-line filtering with rCloud overflow
On-premise RIOS filtering handles continuous attack traffic across your tenant base automatically. rCloud scrubbing absorbs large volumetric floods that would otherwise saturate your upstream capacity. One management interface across both layers. How hybrid DDoS protection works.
- Hardware or VM:
- RE110, RS40, rVM series
- Cloud overflow:
- rCloud
- Traffic steering:
- RioRey Director
- Management:
- rWeb Enterprise with tenant portals
-
VM-based filtering
Deploy RIOS as rVM virtual instances on your own servers instead of RioRey appliances. rVM runs on KVM or VMware ESXi and uses a dedicated NIC in PCI passthrough mode for line-rate filtering. Scale by adding instances as tenant count grows.
- VM options:
- rVM-100, rVM-40, rVM-10, rVM-5, rVM-1
- Management:
- rWeb
-
Dedicated hardware appliance
For providers who prefer dedicated filtering hardware at the network edge. High-availability designs with hardware bypass ensure your network availability is not compromised by the filtering layer itself.
- Hardware:
- RE110, RS40, RE10, RE4010 series
- Management:
- rWeb Enterprise with tenant portals
Why methodology-based detection matters for hosting
Your customers bring unpredictable traffic. Your protection cannot depend on predicting it.
Signature-based systems require rule updates to catch new attack variants. Anomaly-based systems need weeks of traffic history to establish what normal looks like. Neither works well in a hosting environment where the tenant mix, traffic volumes, and application types change continuously. RioRey's detection is built on the underlying mechanics of how DDoS attacks are constructed, as defined in the RioRey Taxonomy of DDoS Attacks. A new customer provisioned today gets the same protection as a long-standing customer, without any configuration, tuning or learning period. That is the only model that works at hosting scale.
What your team and your customers can see
| Capability in rWeb | Your operations team | Your customers via portal |
|---|---|---|
| Real-time traffic view | All tenants, all zones | Their traffic only |
| Attack detail | Full platform view | Their attacks only |
| Historical reporting | Complete history | Their history only |
| Mitigation controls | Full control, real-time | Configurable per tenant |
| Custom reporting | REST API for on-premise devices | Scheduled and on-demand reports |
| rCloud scrubbing events | Same dashboards as on-premise | Same dashboards as on-premise |
Go deeper
Want to see how it works for your platform?
We will walk through your architecture and show you exactly how RioRey fits in.