You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
AnalyticsMarketingPersonalizationExternal media
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
Learn how ZAP Hosting secures your servers with proactive, real-time DDoS protection tailored to each service → Find out more now
10 November 20266 min read4 Views0 helpful
Introduction
DDoS (Distributed Denial of Service) attacks are malicious attempts to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with excessive incoming traffic. To ensure stable and uninterrupted performance for our customers, ZAP Hosting uses dedicated DDoS protection systems that are individually tailored to each server location in the data center.
One of the key technologies in our infrastructure is PletX, a highly adaptive protection platform that filters and blocks attacks in real time. This document explains how PletX works, which services benefit from it, and why it is a real gamechanger especially for performance-critical hosting environments.
FAQ
Frequently asked questions
PletX is ZAP Hosting's highly adaptive DDoS protection platform that filters and blocks attacks in real time. The protection is always active and fully synchronized with the network— all incoming traffic is routed through the PletX filtering system before reaching the infrastructure.
PletX is fully deployed at the FFM/Eygelshoven location, protecting all hosted products there. The rollout for the US locations Ashburn, Dallas, and Los Angeles is currently in preparation.
At active locations, PletX protects game servers, VPS, dedicated servers, TeamSpeak servers and Discord bots—across the entire product portfolio. It filters game and server traffic, not the HTTP/HTTPS traffic of websites.
No, PletX currently does not filter HTTP or HTTPS traffic. For web-based projects, we recommend using Cloudflare instead (Proxy/CDN for websites, Cloudflare Tunnel for FiveM/RedM TxAdmin or other web dashboards).
Yes, in your service's DDoS Manager, you can disable protection anytime using the 'Disable Protection' button and re-enable it with 'Enable Protection'. When disabled, incoming traffic is forwarded unfiltered.
PletX continuously analyzes incoming traffic and recognizes protocol-specific signatures—such as the FiveM handshake on port 30120 or the Minecraft handshake on port 25565—and automatically applies the appropriate rule.
Unrecognized protocols are treated as unknown, which can sometimes cause false positives or unexpected behavior. If affected, open a support chat—PletX can roll out individual adjustments upon request.
Feedback
Was this article helpful?
Your feedback helps us prioritize and improve content.
0 of 0 Users found this article helpful.
Personal support
Need more help than the guide provides?
Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.
Zappy knows this guide and answers you right in the chat.
Navigation
General
Where the Protection is Applied
PletX is already fully deployed at our FFM/Eygelshoven location, protecting all hosted products there – including game servers, VPS, dedicated servers, TeamSpeak servers and Discord bots. PletX filters game and server traffic, not the web traffic of your websites (more on this below). This ensures comprehensive and consistent protection across the entire product portfolio at this location.
The rollout for our US locations in Ashburn, Dallas, and Los Angeles is currently in preparation, and PletX will be available there very soon as well.
How the DDoS Protection Works
The PletX protection at our locations is always active and fully synchronized with our network. All incoming traffic is routed through the PletX filtering system before reaching our infrastructure. This way, harmful traffic is eliminated as early as possible and never reaches your server.
Automatic Protocol Detection
PletX continuously analyzes incoming traffic and recognizes protocol-specific signatures as soon as real traffic appears on a port. For example, when players connect to a FiveM game server via game port 30120, PletX detects the characteristic packet structure and automatically applies the appropriate FiveM rule. This also applies to other services: if a Minecraft server receives traffic on port 25565, the system recognizes the Minecraft handshake and creates a corresponding rule.
When a user connects via SSH on port 22 to a VPS or dedicated server, PletX detects the SSH handshake and activates an SSH rule. For Windows-based systems, RDP traffic on port 3389 is detected and an RDP-specific rule is created.
If WireGuard or OpenVPN is used on a custom port, PletX identifies the first valid exchange and applies the correct VPN rule.
In all cases: once PletX has identified the protocol, only legitimate traffic for that protocol is allowed, while unrelated traffic is filtered out before reaching the server.
Supported Protection Profiles
PletX supports a wide range of common service and game protocols. These include popular games like FiveM, Minecraft, titles using the Steam Source Engine, Metin 2-based services, RakNet-based games, SAMP, Growtopia, and extensions like PlasmoVoice. Voice applications such as TeamSpeak are also automatically recognized.
Besides gaming traffic, PletX also identifies remote access protocols like SSH and RDP as well as secure network protocols like WireGuard and OpenVPN.
Game Servers
- FiveM
- Minecraft
- Various games with Steam Source Engine
- Metin 2 Auth & Channel
- Novalife
- RakNet-based games
- SAMP
- Growtopia
- PlasmoVoice
- and more..
TeamSpeak Servers
TeamSpeak
PlasmoVoice
Remote Access
- SSH
- RDP
VPN and Secure Networks
WireGuard
OpenVPN
All protocols that PletX does not recognize are treated as unknown, which can occasionally lead to false positives or unexpected behavior.
Learned Rules
Protocol detection works per port: the first time real traffic arrives on a port, PletX learns which protocol is used there and creates a rule for this port. You can view the rules learned for your IP address in the DDoS Manager of your server. For each rule, the list shows the port, the detected service, the protocol (TCP/UDP) and the IP address.
In rare cases, a protocol can be detected incorrectly, for example when an application's traffic looks similar to a different protocol. Traffic that does not match the learned rule is then filtered, which can lead to connection problems such as players not being able to join, connection drops or timeouts. Examples are VPN and mesh networking tools like Tailscale (default port UDP 41641) or game servers with uncommon network protocols.
If a rule in the list shows a service that does not match what is actually running on that port, please contact our support and include the details listed in Reporting a Connection Problem to Support.
Web Traffic and Unsupported Services
Currently, PletX does not filter HTTP or HTTPS traffic. Web applications or unsupported protocols may therefore occasionally experience false positives. If you are affected, please proceed as follows:
Open a support chat with ZAP Hosting
We analyze the traffic
PletX can roll out individual adjustments and fixes upon request
This approach is especially intended for unusual or specialized services. For web-based projects, we still recommend using Cloudflare. Ideally, Cloudflare Proxy or CDN for websites and Cloudflare Tunnel for FiveM/RedM TxAdmin or other web dashboards.
Temporary Deactivation of Protection
If your server has its own IP address, you can temporarily turn off the PletX filtering for that IP address yourself. Open the DDoS Manager of your server, switch off the DDoS protection toggle and confirm the prompt with Disable Protection. You can switch the protection back on at any time in the same place.
Info
Only available for your own IP addresses: The protection can only be turned off for IP addresses that belong exclusively to your service, for example the IP address of a VPS, a dedicated server or a game server with its own IP address. It is not possible for shared IP addresses, such as game servers on a shared IP address or TeamSpeak servers, because turning it off would affect all other services on the same IP address.
While the protection is turned off:
Incoming traffic reaches your server unfiltered and no rules are applied to any port. Your server is not protected against DDoS attacks during this time.
To protect our network from unfiltered attacks, bandwidth is limited to 1 Gbit/s, regardless of the port speed of your service.
We recommend turning the protection off only for troubleshooting, for example to check whether a connection problem is related to the filtering. Please switch it back on once you are done. If a problem only occurs while the protection is on, contact our support so we can analyze it together with PletX, allowing you to run your server with protection enabled again.
Reporting a Connection Problem to Support
If you suspect that the DDoS protection is causing connection problems, please open a support ticket and include as much of the following information as possible. This allows us to analyze the problem without having to ask for missing details first.
IP address and port of the affected service, together with the protocol (TCP or UDP).
Time of the problem in UTC: when it started, and whether it is permanent or only happens from time to time. For intermittent problems, list a few exact times.
What exactly happens, for example players cannot join, the connection drops after a while, packet loss or timeouts. Error messages from the client or server logs are very helpful.
Whether the problem also occurs with the protection turned off (only possible with your own IP address, see Temporary Deactivation of Protection).
If possible, a packet capture (pcap) recorded on your server while the problem occurs, ideally one with the protection turned on and one with the protection turned off. On Linux you can use tcpdump, for example tcpdump -i any -n -w protection-on.pcap udp port 41641 (adjust the protocol and port to your service). On Windows you can use Wireshark.
Info
Bandwidth limit while protection is off: Keep in mind that bandwidth is limited to 1 Gbit/s while the protection is turned off. Turn the protection back on once you have finished your test or packet capture.
Server hosting from €2.49 / month, online instantly, DDoS protection included.
Preferred source on Google
