The setup: what a real attack looks like
A serious attack on a Minecraft server is rarely one thing. A typical incident combines a Layer-4 volumetric flood (raw packets to saturate the uplink), a Layer-7 join flood (thousands of bots speaking valid Minecraft protocol), and ping/MOTD spam (status requests to burn CPU). A generic firewall handles the first and waves the other two straight through. Cryo handles all three at different stages. Here is the order.
Stage 1 — Anycast absorption (the volumetric layer)
Every connection enters at the nearest of Cloudflare Spectrum's 330+ anycast cities, not at your server. Raw volumetric floods are absorbed here, spread across 500+ Tbps of global capacity — no single node ever sees the whole attack. Your origin IP is never exposed, so there is nothing for a volumetric attacker to aim at. This is the layer that makes null-routing — a host taking your server offline to protect itself — stop happening.
Stage 2 — Protocol parsing (where generic filtering ends)
What survives the edge and speaks Minecraft is handed to Cryo, our Layer-7 engine, running on our own network (AS216013). Cryo does what a packet filter cannot: it reads the protocol.
- Handshake parsing — the engine reads the protocol version and the target hostname from the handshake, and routes on it. Malformed or nonsensical handshakes are dropped immediately.
- Status vs. login — a status ping and a login attempt are different packets with different costs. Cryo answers pings from edge cache (so ping floods never reach your backend) and treats logins as the thing worth scrutinizing.
- Hostname awareness — traffic for a hostname you don't serve is dropped, not forwarded. The engine knows your networks.
Stage 3 — Adaptive rate limits + auto-UAM
Cryo tracks per-IP and global connection budgets in real time. When combined ping+login connections-per-second cross an adaptive threshold — the signature of a join flood — auto-UAM (Under Attack Mode) engages automatically: limits tighten, and every new join is routed to verification. You don't push a button; the engine reacts in real time and relaxes again when the flood stops. A representative mid-sized join flood peaks in the low hundreds of thousands of CPS; the pipeline absorbs that at the edge while your existing players keep playing.
Stage 4 — Verification (the CryoLimbo gauntlet)
Flagged joins are detoured into CryoLimbo, a lightweight limbo world, and made to prove they're human — from a simple captcha up to multi-level behavioral checks — before they ever touch your backend. A bot that can't pass never allocates a connection slot, a thread or a login event on your hardware. This is the difference between fighting bots at the edge and fighting them in your server console: by the time a server-side antibot plugin acts, the connection has already cost you.
Stage 5 — Identity checks that follow the account, not the IP
- **AntiVPN** classifies the connection's origin — VPN, proxy, or datacenter range — in real time, non-blocking, so clean players never wait on a lookup.
- Fingerprint bans ban the client, not just the address — a rotating-proxy bot that changes IP every join still carries the same fingerprint.
- **Stolen-account detection** kicks accounts flagged as stolen or credential-leaked. A patient human on a residential line with a stolen premium account passes AntiVPN and the gauntlet — this check catches what nothing else does, because it follows the account itself.
The result: zero at the origin
By the time traffic reaches your server, the volumetric flood was absorbed at the edge, the ping spam was answered from cache, the bots were held in limbo, and the flagged accounts were kicked. What arrives is clean players — delivered with their real IPs via PROXY protocol, so your bans and plugins keep working. On the live status page you can watch the same per-PoP uptime and inter-PoP latency data our own monitoring runs on. And you can see this pipeline in the panel: the attack view, the tunable antibot config, and the connection log that explains every verdict.
Common questions
What makes Cryo different from generic DDoS filtering?+
Generic filtering makes decisions on packet shape — source, rate, size — because it can't read the application. Cryo parses the Minecraft protocol itself: it reads the handshake, evaluates the target hostname, distinguishes a status ping from a login, and holds suspicious joins for verification. A bot speaking valid Minecraft protocol looks identical to a real player at Layer 4; only a protocol-aware engine tells them apart without kicking real players.
Does the extra parsing add latency?+
Barely measurable. Parsing a handshake is cheap relative to the network round-trip, it happens inline at the edge PoP nearest the player, and MOTD responses are served from edge cache. Typical added processing overhead is under a millisecond — far less than the latency saved by anycast entry being closer than your origin.
What is auto-UAM?+
Under Attack Mode. When combined ping+login connections-per-second cross an adaptive threshold, Cryo automatically tightens rate limits and routes every new join through CryoLimbo verification, without you touching anything. It relaxes again when traffic normalizes. You get a Discord/webhook alert with live and peak CPS while it runs.
What happens to a legitimate player during an attack?+
In most cases, nothing they'd notice. The pipeline is deliberately asymmetric: clean connections from residential ISPs pass a few wire-speed checks and reach your backend with their real IP. Only connections the risk engine flags — new IPs mid-attack, datacenter ranges, protocol anomalies — are sent to the verification gauntlet.
How much attack traffic can the network absorb?+
Volumetric floods hit Cloudflare Spectrum's anycast edge first — 500+ Tbps of provisioned capacity across 330+ cities. The largest attack mitigated on this network measured 7.15 Tbps; the largest Layer-7 event, 50 million connections. Protocol-level filtering then runs on Arvoris' own network (AS216013, 600+ Gbps).
Every plan, including the free tier, runs this exact pipeline — the paid tiers add capacity and control, not safety. Put it in front of your server in about five minutes.