Websites and public APIs face constant CC and bot noise. WAF, bot management, and cache must share one edge policy.
Typical pressures
- Slowloris-style L7 attacks
- Scanners and credential stuffing causing 5xx
- Campaign traffic spikes without capacity plans
- Wildcard and multi-domain policy complexity
Architecture
L7 protection layout
Anycast → scrub → WAF → cache → origin with only clean traffic touching sources.
- 01Smart DNS / HTTPS DNS
- 02Edge WAF and bot challenges
- 03CC rate limits and behavior scoring
- 04Split static cache vs dynamic origin
Focus areas
WAF sets
OWASP baselines plus custom URI/header rules.
CC scrub
Tiered limits, JS challenges, fingerprint feeds.
Unlimited hostnames
Veikor CDN plans without per-domain surcharges.
API vs static
Path-based cache and protection profiles.
Typical scenarios
L7 policy by site type
Scenario path
Cache + baseline WAF
Mostly static; CC and scanner blocks.
Visitor → CDN → origin
Scenario path
Bot and rate limits
Limits by app and path; dynamic origin.
API → gateway → service
Scenario path
Bursts and CC
Campaign peaks; anti-abuse and queuing.
Campaign → edge scale → origin
Global attack posture · live
Traffic split by type and source
Attack mix
Sources / scrub PoPs
Four-layer defense
Only the remainder reaches origin
Global live attack intelligence
Attack paths · actions · severity
High-defense IP is the L4 layer inside CDN: 1:1 port forwarding to origin—not a separate product or the dedicated server line.
Attack arcs · source to scrub PoP
Attack mix
Top sources
- 1Russia93.6M
- 2United States31.9M
- 3Ukraine36.4M
- 4China25.1M
- 5Brazil22.5M
- 6India18.2M
Top targets
- 1Singapore79.7M
- 2Hong Kong41.9M
- 3Tokyo40.4M
- 4Frankfurt36.6M
- 5Los Angeles36.5M
- 6Taipei16.2M
Live scrubbing path
Live log · city to city