Understanding VergeCloud’s DDoS Challenge Modes

VergeCloud’s DDoS protection uses multiple layers of mitigation to protect against both network-level (Layer 3 & 4) and application-level (Layer 7) attacks. Each challenge mode handles threats differently. This guide explains each type to observe their behavior.

No Challenge Mode (L3/L4 Protection Only)

What It Is:  

This mode protects your applications against network-layer attacks such as:

• TCP SYN floods

• UDP floods

• ICMP/volumetric attacks

• IP spoofing

Protection is applied at the edge without introducing any delays or browser-level checks.

How VergeCloud Does It Using Anycast:  

When you enable No Challenge Mode, your domain is pointed to a VergeCloud Anycast IP address. This IP is globally advertised by multiple edge locations in our network.

Anycast ensures that all traffic — including attack traffic — is routed to the nearest VergeCloud edge.

Here’s what happens next:

1. The VergeCloud edge node receives and inspects traffic before forwarding it to your origin server.

2. If the system detects Layer 3 or Layer 4 anomalies (e.g., floods, spoofed IPs, malformed packets), it:

• Drops the packets immediately at the edge.

• Optionally rate-limits the traffic source.

• Logs the event for your visibility.

3. Clean traffic is passed through without requiring cookies, JavaScript, or CAPTCHA challenges — making this mode fully transparent to human users and API clients.

This Anycast-based architecture distributes traffic globally, preventing attackers from overwhelming a single point in your infrastructure.

Cookie Challenge

What it is:  

• Blocks bots by setting and validating a cookie on the client.

• Legitimate browsers pass; headless tools or bots without cookie support are blocked.

Screenshot

JavaScript Challenge  

What it is:  

• Sends a JS-based challenge that the browser must solve (often a dynamic math or timing check).

• Defeats bots that don’t execute JavaScript.

Screenshot

Captcha Challenge  

What it is:  

• Forces users to solve a CAPTCHA (e.g., Google reCAPTCHA or VergeCloud native) to proceed.

• Blocks even advanced bots and requires human interaction.

Screenshot

Conclusion

By understanding how each mode works, you can ensure that VergeCloud is not only active but also effectively protecting your infrastructure in real time.

Choose the right challenge level for your use case, and combine it with monitoring and analytics to stay one step ahead of DDoS threats.