Download websites that use DDoS-Guard

About DDoS-Guard

When a request reaches a protected site, the first machine to answer is not the site. A scrubbing network sits in front, absorbs the traffic it judges hostile and passes the rest through, which means the technology we detect is the shield rather than the server. Every row for DDoS-Guard should be read that way. The domain is fronted by the provider, and where the content actually lives is a separate question our detection does not answer.

The geography is the striking part of this record. As of September 2026 the file holds 678,600 sites behind the service, and 567,443 of them are in Russia, with .ru the domain ending we see most often. A concentration at that level makes the provider less a technology signal than a regional infrastructure one. Presence tells you which market a site operates in, which payment and support relationships were practical for its owner, and often which jurisdiction its operators are comfortable working under.

The provider has also drawn attention beyond its home market, because sites declined or removed by other networks have surfaced behind it, and analysts who track abuse infrastructure watch its footprint for that reason. Nothing in a detection implies anything about a particular domain, and the honest use of the list is the opposite of guilt by association. What the list offers is a population to screen, not a verdict to apply to a name. Founded in 2011, the company built the usual protective stack around scrubbing, including a web application firewall, certificate termination and content delivery, so a customer is buying performance and convenience as well as protection.

There is a further reason the footprint is worth measuring rather than assumed. Protection services are bought under pressure, usually after an incident, so their customer lists record where attacks have actually landed rather than where owners thought they might. A map of who is shielded is an indirect map of who has been targeted, which is information that no site publishes about itself.

Two limits matter more here than in most categories. Sites move between protection providers quickly, sometimes during an attack and sometimes within days of one, so a row is a snapshot taken at crawl time and the date of the crawl carries as much weight as the value in the row. And because the proxy terminates the connection, address based analysis of the domain returns the provider rather than the origin, which flattens genuinely different setups into a single label and makes co-occurring infrastructure columns less reliable for these domains than for unproxied ones.

Threat intelligence teams, brand protection groups, compliance functions screening suppliers and researchers mapping how the web is fronted all need the same material, and a domain lookup gives none of it. A downloadable list lets you count the population, cut it by country and domain ending, intersect it with a watch list you already maintain, and compare consecutive snapshots to see which domains arrived and which left. Movement between providers is the real finding in this category, and movement only becomes visible when you hold the whole set rather than one answer at a time.