Order and use a custom profile

A custom profile is a DDoS Shield profile that you order as a service. It holds one protection mode, one set of rate limits and rules, and one choice of what happens when no rule matches, for every floating IP you bind to it. It also lets you block traffic sources on those addresses. The Profiles tab of DDoS Shield lists your custom profiles.

An address can also have a profile of its own, at no charge, from its Shield tab (Change a floating IP's DDoS protection). A custom profile is for addresses that should share their settings, and for blocking sources.

• A custom profile filters only the floating IPs you bind to it. It cannot filter a server's shared address (How DDoS Shield works).
• An address uses one profile at a time. When you bind an address that has a profile of its own, it moves to the custom profile, and the rules of its own profile stop applying to it.
• Every address you bind shares the profile's settings. A change on the Shield tab of one of them applies to all of them.
• The plans' descriptions name packet rates, but every plan starts with the same rate limits as any new profile (Rate limits). Set the limits you need yourself, as Change the settings shows.
• For the first invoice, credit on your account pays first. Otherwise you pay by card or PayPal on the page the order lands on (How the first payment works).

Open the order page in one of these ways:

• In the sidebar, select DDoS Shield, then Order custom profile at the top of the page. The button is on every tab, and the Profiles tab repeats it while you have no custom profile.
• On Order a service, select the DDoS Shield card under Network and security.

The page has three numbered sections, and the summary under Your order sits beside them. On a phone the summary follows the sections, and Review order at the bottom of the screen takes you to it.

1. Under Plan, choose a plan. Each card shows the plan's description and its price.
2. Choose the billing cycle with the buttons beside the Plan heading, such as Monthly. A longer term names what it saves, such as Annually · save 20%.
3. Under Profile, enter a Profile name of up to 100 characters, such as Game servers. The profile's title on the Profiles tab is made from it, and the Shield tab of each bound address shows it. When you leave it empty, we name the profile Custom Shield followed by its service ID.
4. Choose the Protection mode. Custom, which the page starts on, applies the profile's own rate limits. Standard applies the platform's limits with your rules added (Protection modes). The order page does not offer Passthrough.
5. Under When no rule matches, choose Allow, which the page starts on, or Drop. The line under the buttons says what your choice does, such as Traffic passes unless a rule drops it.
6. Under Addresses to protect, tick each floating IP that the profile should filter. The line under an address says where it is now: On the platform scrubbing today., or It has a custom profile already. Binding moves it to this one. for an address with a profile of its own or on another custom profile. You can leave every box empty and bind addresses later.
7. Check the summary. It lists the plan with its billing cycle, the Protection mode and the Addresses, such as 2 addresses or None yet; bind them later, with Change beside each to go back to its section. The Total shows the price and what is due today, and the line under it says how the first invoice is paid.
8. Select the button under the summary. It reads Place order and pay when you pay after placing the order, and Place order when your credit pays for it or your account is billed in arrears. While the plan cannot be ordered, the button is greyed out and the line under it says why, such as This plan is sold out right now.

If we refuse the order, Could not place the order appears above the button with the reason, and your choices stay as they were.

Once you place it, the order's own page opens. When its title is Order placed, payment due, pay under Pay invoice with account credit, a saved card or PayPal account, or a new card (Pay and follow the order). To pay later, leave the page and pay the invoice under Invoices.

We set the profile up once its invoice is paid, and we bind the addresses you ticked. Until then, its card on the Profiles tab shows Setting up, and you cannot bind addresses to it. The order's page updates on its own. Its title becomes Your order is ready when the profile is active, and Open profile at the top of the page then opens DDoS Shield.

The order pages for Cloud Compute, Container Apps and Floating IPs offer a DDoS Shield profile card under Add-ons (Add products to the order). A profile you add there differs from one you order on its own page:

• It protects the addresses in that order. On an instance, those are its included public IPv4 and any floating IPs you add. On a server, it is the dedicated IPv4 address you add. On a floating IP order, it is the new address.
• It starts in Custom mode, with Allow when no rule matches.
• Its Profile name takes up to 40 characters. When you leave it empty, the profile takes the instance's or server's name.
• Until the order has an address, the card's switch stays off and the card says why: Keep the included public IPv4 first. The profile protects addresses you own. on Cloud Compute, or Add the dedicated IPv4 address first. The profile protects addresses you own. on Container Apps.

Once it is set up, the profile appears on the Profiles tab like any other.

The tab shows a card for each custom profile that has not ended. With none, it shows No custom DDoS profiles yet and Order custom profile.

A profile's card shows:

• Its slug as the title, such as game-servers-1043-a1b2: the name in lower case with hyphens, the service ID and four random characters. Until we set the profile up, the title is the plan's name.
• The plan, its price per billing cycle and the next renewal date, with the service's status, such as Active.
• The protection mode that the profile was ordered with, such as Custom mode. The Shield tab of a bound address shows the mode in use.
• Bound addresses: each address bound to the profile, which links to its Shield tab, with Unbind… beside it. With none, the card says No address is bound yet. The profile protects nothing until you bind one.
• Bind an address and Block a source, which the sections below describe.
• Open Billing, which opens the service's Billing tab.

Under the cards, Per-address profiles lists each address that has a profile of its own, with that profile's name and mode. Manage opens the address's Shield tab.

1. On the profile's card, choose the address under Bind an address.
2. Select Bind IP.

A message confirms IP bound to custom profile, and the address appears under Bound addresses. DDoS Shield then filters it with the profile's settings.

The list offers only your own floating IPs that are on the platform default profile. When none is left, the card says Every address on the account is already on a custom profile. To move an address from another custom profile, unbind it there first. To move an address that has a profile of its own, bind it with bind_ip (With the API).

1. Under Bound addresses, select Unbind… beside the address.
2. Read the dialog and select Unbind.

A message confirms IP unbound; uses platform default scrubbing. The address goes back to the platform default profile, and the profile's rules and limits stop applying to it.

Blocks made on the address stay in place, and this profile can no longer remove them. Remove them before you unbind the address, as Block a source explains.

The address goes back to the platform default profile even when it had a profile of its own before you bound it. In that case, Customise on the address's Shield tab brings its own profile back, with the settings and rules it had.

The profile's protection mode, rate limits, rules and When no rule matches are on the Shield tab of each address bound to it.

1. Under Bound addresses, select an address. Its Shield tab opens, with the profile's name on the profile card.
2. Change the profile or its rules as Change a floating IP's DDoS protection shows.

To aim a rule at one of the addresses, enter that address as the rule's Destination prefix, such as 203.0.113.10/32. The rule then matches only traffic to that address.

The rate limits apply to each bound address on its own. An aggregate limit of 10,000,000 packets per second lets each address receive up to that much, rather than all of them together.

We drop every packet from a blocked source before any rule decides, so an Allow rule cannot let it through. You block a source on one of the addresses bound to the profile, so bind an address first.

1. On the profile's card, enter the sender's address under Block a source, such as 198.51.100.7.
2. When more than one address is bound, choose under On the address that the block is on.
3. Select Block source.

A message confirms Blocked 198.51.100.7.

A block works differently from a rule:

• It is on one of the profile's addresses: the one you choose under On, or the only one bound.
• It blocks one sender address. The field also takes a prefix, such as 198.51.100.0/24, but a prefix blocks nothing. To drop a range, add a Drop rule with the range as its Source prefix (Add a rule).
• It never expires.
• It stays in place when you unbind its address and when the profile ends.
• The card does not list your blocks and cannot remove one. Remove a block with whitelist_ip and the block's id, which the answer to blacklist_ip gives (With the API). The profile must be active, and the block's address must still be bound to it. For a block you made in the dashboard, contact support with the address.

A custom profile is billed like any other service (Invoices).

We suspend the profile when an invoice for it stays unpaid (Failed payments and suspended services). While it is suspended:

• We set the profile to Passthrough, so DDoS Shield stops filtering its addresses and an attack reaches them in full.
• Bind IP, Unbind… and Block source fail, with a message that ends Service is not active.

Pay the open invoice to lift the suspension. We then set the profile back to the mode its card shows, such as Custom mode, or to Custom when the card shows Passthrough mode. If you changed the mode on a Shield tab since the order, set it again there.

You can move a profile to another billing cycle of its plan on its Billing tab, but not to another plan, because each plan is a product of its own (Change a service's plan). To move to another plan, order a new profile, bind your addresses to it and cancel the old one.

Select Open Billing on the profile's card and cancel the service there (Cancel a service). When the service ends:

• Every bound address goes back to the platform default profile, and the profile's rules stop applying.
• The card leaves the Profiles tab.
• Your blocks stay in place, and nothing can remove them with this profile any more. Remove them with whitelist_ip before the service ends.

The card shows Setting up

The order waits for payment. Pay its invoice, and we set the profile up once it is paid.

The card shows Profile is failed, or Profile is provisioning for a long time

We could not set the profile up. Contact support with the plan and the time you ordered.

An address is missing from Addresses to protect

The list holds the floating IPs we have assigned to you. An address that you ordered but that is not ready yet is left out. Order the profile without it, and bind it once it is ready.

Could not load your addresses

The list of floating IPs did not load, and the message gives the reason. Reload the page, or order the profile and bind addresses once it is set up.

Could not place the order with ip_service_ids must name your own floating IPs that are not terminated or cancelled.

An address you ticked ended after the page loaded. The message ends with its service ID, such as Remove 214. Reload the page and tick the addresses again.

No DDoS Shield plans yet

DDoS Shield is not in the catalogue for your account. Contact support if you expected it.

Could not load the plans

The plans did not load. Select Try again, or reload the page.

An address is missing from Bind an address

It has a profile of its own, or it is on another custom profile. Bind an address explains how to move it.

An address you ticked in the order is not under Bound addresses

We skip an address that we cannot bind when we set the profile up, such as one that was cancelled in the meantime. Bind it now.

Could not bind IP: Service is not active, or the same message for another action

The profile is suspended, or we have not set it up yet. Pay its open invoice.

Bind an address to this profile first, then block the source on it.

No address is bound to the profile, so there is nothing to block the source on. Bind an address, then block the source.

This profile protects more than one address. Set ip_service_id to the one to block the source on.

The block did not say which address it is on. Choose an address under On, then select Block source again.

The profile's rate limits have no effect

The profile is in Standard mode, which uses the platform's limits. Set Protection mode to Custom on the Shield tab of a bound address.

A blocked sender still reaches an address

The address is in Passthrough, or you blocked a prefix, which blocks nothing. Add a Drop rule for the range.

• How DDoS Shield works
• Change a floating IP's DDoS protection
• Read attack events
• Order a service
• Cancel a service

The custom profile plans are the products with module_name antiddos in GET /products/. Order one with POST /services/order, as Order a service explains:

curl -X POST https://api.coritan.com/api/v1/services/order \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": 41,
    "pricing_id": 118,
    "config": {
      "profile_name": "Game servers",
      "protection_mode": "custom",
      "default_action": "allow",
      "ip_service_ids": [214, 215],
      "per_source_pps": 50000
    }
  }'

A config that fails a check answers 422 with {"detail": {"errors": [...]}}, such as protection_mode must be standard|custom|passthrough, profile_name must be text of 191 characters or fewer, or ip_service_ids must name your own floating IPs that are not terminated or cancelled. Remove 902. The API does not check the two limits, so keep them within their ranges. When you send a hostname, the card shows it as the title in place of the slug.

A profile takes no add-ons. To add a profile to an order for an instance, a server or a floating IP, put it in that order's addons, with an optional profile_name of up to 40 characters in its config. The order names the addresses itself, so an add-on whose config has ip_service_ids answers 422 with Shield Custom Profile protects the addresses in this order, so leave ip_service_ids out of its config. (Add-ons in the order).

The answer's service.id is the profile's service ID. Once we have set the profile up, GET /services/{service_ref} returns its module_data, with the profile's profile_id and profile_slug. The addresses bound to it are the ones whose protection.profile_id in GET /api/v1/client/shield/status is that profile_id (With the API).

POST /services/{service_ref}/actions runs an action on the profile, with service_ref set to its service ID. Each action reaches only your own floating IPs and the addresses bound to this profile:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "bind_ip", "params": {"ip_service_id": 216}}'

{"success": true, "message": "IP bound to custom profile", "data": {"ip_service_id": 216, "inventory_id": 5122, "profile_id": 58, "enabled": true, "address": "203.0.113.12"}}

Every answer has success, message and data. An action that fails can still answer 200, with "success": false and the reason in message, so check success.

With no address bound, view_alerts answers "success": true with an empty data.events and No address is bound to this profile, so it has no attack events. Read attack events with GET /api/v1/client/shield/events instead, because it covers every address on your account (Read attack events).

To block a source, send one IPv4 address, and the ip_service_id of the bound address to block it on:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "blacklist_ip", "params": {"ip_address": "198.51.100.7", "ip_service_id": 214, "reason": "UDP flood"}}'

{
  "success": true,
  "message": "Blocked 198.51.100.7",
  "data": {
    "block": {"id": 881, "address": "198.51.100.7", "prefix_len": 32, "scope": "subject", "ip_service_id": 214, "reason": "UDP flood", "source": "manual", "expires_at": null, "created_at": "2026-09-26T09:12:40"}
  }
}

Keep the block's id, because you need it to remove the block and no request lists your blocks. We store ip_address as you send it without checking it, and an address we cannot read, or a prefix, blocks nothing. You can leave out ip_service_id while one address is bound.

To remove the block, while address 214 is still bound to the profile:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "whitelist_ip", "params": {"block_id": 881}}'

{"success": true, "message": "Removed block 881", "data": null}

The answers you can act on:

The services API reference lists every field.