DDoS filters, abuse tickets, and what we will not host

Included filters cover volumetric L3/L4; L7 floods that look like users stay your problem. How abuse mail is answered here, and what no invoice covers.

Published 2026-08-30 · Updated 2026-09-29 · NulNet Editorial

What “DDoS included” means

Volumetric filtering — SYN storms, UDP amplification, ACK abuse — rides every SKU at the network edge, with no toggle and no per-IP fee: L3/L4 on every VPS, storage and dedicated tier, and an L3/L7 scrubber at the top of the metal ladder on Citadel's 25 Gbps uplink. Inclusion does not mean application-layer judgment: an HTTP flood that mimics users crosses as legitimate traffic — rate-limiter work, not filter work.

How to answer an abuse mail

Abuse reports get answered with data, and the desk reads for three things: the IP, the UTC timestamp, and the process that owned the socket. A Tor Project: relay operations exit operator should publish a contact and the exit policy — exits attract complaints by design, and a reachable operator keeps the address routable. A US U.S. Copyright Office: DMCA template is not a power switch here; it is copyright mail, filed as such.

What no invoice covers

Named directly, because every host has a list and this is ours: CSAM, phishing, spam and attack traffic are prohibited on every plan, paid with any of the sixteen coins, in every location. Child-safety reports route to the abuse address with URLs and are handled as the serious reports they are — that is not a copyright debate. If the project needs those categories, do not order; the billing method changes nothing.

Null-routing and escalation

Null-routing exists for the case where the AUP is being violated flagrantly and the ticket sits unanswered — a last tool, not a first response. The normal sequence is a report, your reply with facts, a fix on your side, and the address restored to quiet. Operators who answer with timestamps and process names rarely reach step three.

Shrinking the target

Best filtering is a smaller attack surface: a game server with a community whitelist presents a narrow face, a VPN endpoint answers one protocol, and a web app behind caching survives hammering that would flatten a bare origin. Unmetered ports help absorption — 1 Gbps at entry VPS, multi-gigabit up the ladder — and IPMI on dedicated tiers means a wedged box reimages out-of-band. Bulk data belongs on storage, from $24.