Get early access
Features · Security · Attack Mode
UNDER ATTACK MODE

When the bots show up,
you don't have to.

One toggle. Attack-grade telemetry every five seconds, one-click IP bans, Cloudflare's Under-Attack mode wired to the same switch — and an AI postmortem the moment the dust settles.

Get early access How it fires →
app.hostatlas.io / servers / keywest / attack-mode LIVE 00:14:23 elapsed
req / s
14,820
+ 9.4×
unique ips
3,412
82 % new
syn_recv
740
flood
5xx rate
38 %
backend strain
bandwidth
312 MB/s
peak so far
ips banned
147
auto + manual
Top offenders · last 60 s refresh 5 s
●93.184.215.142,118RUbanned · 24h
●198.51.100.421,847CNbanned · 24h
●203.0.113.91912TRban · 1h
●192.0.2.183744VNban · 1h
●45.33.32.156218USmonitor
access.log · tail -f
14:32:0850393.184.215.14 POST /api/v1/auth
14:32:0850393.184.215.14 POST /api/v1/auth
14:32:08503198.51.100.42 GET /
14:32:08429203.0.113.91 GET /api/v1/probe
14:32:0820045.33.32.156 GET /healthz
14:32:0950393.184.215.14 POST /api/v1/auth
14:32:09503198.51.100.42 GET /
14:32:09429192.0.2.183 GET /api/v1/login
14:32:09429198.51.100.42 GET /
14:32:1050393.184.215.14 POST /api/v1/auth
14:32:1020045.33.32.156 GET /healthz
14:32:10503203.0.113.91 GET /api/v1/probe
— Triggers

It usually fires before you notice.

Your alert rules can flip the switch automatically — or you flip it yourself when the dashboards start to scream. Either way, you're already three minutes ahead of the bots.

SYN flood

SYN_RECV climbing fast

The agent watches kernel-side connection state. When SYN_RECV outruns ESTABLISHED by an order of magnitude, that's not a load spike — that's a flood.

SYN_RECV > 100 && ratio > 10×
HTTP flood

Requests per second

Per-domain request rate parsed live from access logs. When sustained traffic crosses your baseline by the threshold, Attack Mode comes online.

req/s > 5,000 for 30 s
Manual

The big red button

One click on the server detail page. Useful when you can see something nobody else has flagged yet — you don't need a metric to know.

always available
— Countermeasures

What it actually does.

No vague "AI mitigation" claims. Specific, reversible actions you can audit afterward.

One-click IP bans

Click an offending IP, choose a duration, done. The agent writes the rule via your firewall — auto-detects whichever you're running. Bans roll back automatically when their clock runs out.

1h 24h 7d permanent

Top-offenders detected automatically can be banned in bulk from one row.

Cloudflare Under-Attack

If your domains are behind Cloudflare and you've connected them, one toggle here flips the proxied zones into Under-Attack mode. Cache purge in the same control panel. Reverts when you deactivate.

5-second telemetry

Normal monitoring is fine for normal days. During an attack the agent collects connection state, log diffs, request paths and response codes every five seconds — so the analysis later isn't guessing.

— After the storm

When you deactivate, you get a paper trail.

Closing Attack Mode files an incident with everything that happened — and an AI summary that you can hand to your team or your auditor.

Incident · keywest · 2026-04-22 14:18 → 14:43 AI summary

Attack profile

Coordinated HTTP flood from 3,412 unique IPs targeting /api/v1/auth. Peak 14,820 req/s at 14:32. Top offenders concentrated in RU/CN/TR/VN ranges typical of a hijacked-router botnet.

What worked

  • Cloudflare Under-Attack toggled at 14:21 deflected ~74 % of traffic at edge.
  • Bulk ban on top 50 offenders cut origin pressure by another ~18 %.
  • SYN flood subsided at 14:38; 5xx rate normalised by 14:43.

Recommendations

  • Add rate-limit on /api/v1/auth at the edge — same path was hit in February.
  • Promote 5 IP ranges to permanent block — recurring offenders.
  • Move api-prod behind the same Cloudflare zone to harden the next event.

Telemetry retained

25 min of 5-second snapshots — connection state, access logs, response codes, banned IPs and durations — kept for 90 days on this plan.

Sleep through the next one.

One toggle, one paper trail, zero vendor mitigation theatre.

Get early access All features