Deflecto runs on a global anycast network. The same IP addresses are announced from every point of presence, so an attack is automatically spread across all of them instead of concentrated on one.
The filtering pipeline
- Packet filters (XDP/eBPF) drop malformed, spoofed and amplification traffic at line rate before it reaches the kernel network stack.
- Connection layer terminates TCP and TLS, enforces handshake and idle timeouts and fingerprints the client.
- Request scoring combines reputation, fingerprint consistency, behaviour and WAF signatures into a single risk score.
- Decision: pass, challenge (proof-of-work), rate-limit or drop.
- Origin delivery over pooled keep-alive connections with health checks, retries and origin shielding.
Observability
Every decision is logged with its reasons. Logs stream to your SIEM (Splunk, Elastic, Datadog, S3) in near real time, and the dashboard shows allowed, challenged and dropped traffic side by side.