MojoShield
 

Anyone using MojoShield? What's your experience?

I don't have any experience with this kind of things... not sure what to expect...pros & cons..???

I tested it for a few weeks when I moved over to MojoHost last year. I opted not to continue using it, but I know what's involved and have everything configured so I can get it up and running quickly if there's ever an attack on my server.

They basically resell the StackPath WAF service (google it to see the marketing materials on it).

The basic idea is that people are vetted the first time they hit your site. The vetting is done by edge servers, so the attack traffic never gets near your server. That vetting process may involve a "Please wait…" type of dialog (which isn't the best user experience). Once the user is vetted things work much more quickly, BUT if your user does something suspicious they'll get that request blocked. If they do too many suspicious things, then their IP can get blocked. The issue is that things that are completely normal for your site may seem suspicious to StackPath. You'll need to write rules to allow those exceptions. If I remember correctly you're allowed a certain number of rules after which there's an additional charge. The point being it needs to be tuned and turning it on with no tuning may result in good requests and IPs being blocked.

The other issue is how its billed. It's billed per domain (domain & www-domain are included, subdomains are extra) and also on number of requests. So if you have a lot of sites on your server it can get expensive quickly. And if you have a lot of AJAX going on (and hence a lot of requests) the price can also be pretty steep. I tried it out on a pretty average forum site and the reason why I stopped after 2-3 weeks was because I was about to hit my monthly limit on pageviews.

Bottom line for me was it will be useful when there's an attack. I'll deploy it just as needed (site being attacked first, and then add other sites as they start getting attacked). The price might be steep if the attacker is persistent, but if I prorate the cost over all the months when I didn't use it, I can justify the outlay. It will absolutely stop an attack, and I'd rather give money to Mojohost than to an attacker.

You can't just turn on a WAF when you are being attacked. You cannot assume that they are going to be attacking the domain and not your server's IP, and your server's IP is exposed until you turn on the WAF.

Thanks for considering MojoShield, miXXXture!

Hi Jay. I do have some good news about how requests are billed though - you'd only pay for good requests that do get passed to your server. Requests that get blocked don't get accounted for billing.

:thumbsup:thumbsup

To OP,

Just use Stackpath's WAF and save a few bucks. Mojo is just reselling it.. and a couple hosts here are just reselling Mojo. Cut out the middle men. :2 cents:

Good luck with that, we are selling for much less than they retail it for. Typical GFY post. Do you think we are dipshit enough to try to sell any resold product or service for more than buyers can source it for direct? Of course not. And it's not just a straight resale, all of the support and setup work is done by our team. A lot of effort has been made to advance rulesets for the adult audience.

As Natalie said above, only "good" requests are charged. So, when there is no charge for bad requests when you are under attack. 10 million requests are included with each base plan and each additional million requests results in a usage fee of $0.50.

A point of clarification on "per domain" charges, we are no longer charging for subdomains.

As SX3_Jay has said, there is time and effort required with setup and validating or adding custom rules. Since we have been offering the product for a long time now, we have continued to grow the list of "default" rules that are included based on the requirements of our typical clients.

It should be noted that MojoHost has network-wide denial of service attack protection now. We have not yet marketed or press released this, but it's DDOS protection for everyone on MojoHost for up to hundreds of gigabits of traffic. This is an included service now at no additional charge.

Having said all of of that, there are plenty of great use cases for adding MojoShield as a product. If people are looking to hide who they are because they are doing bad things like stealing content, sorry, we don't want your traffic and you should just go use CloudFlare. If you're looking to have a mature solution that covers your entire business, my recommendation is to use both MojoShield to obfuscate your server IP address and MojoDNS (the StackPath product) to also achieve scale, protection and obfuscation at a DNS level.

Have a great day! As with anything sold from MojoHost, we have a satisfaction guarantee.

Brad

Yes, the response will depend on the nature of the attack and everything on the IP may need to be moved to another IP and put behind the WAF. Maybe I didn't state it properly, but the point was I'd use as much of MojoShield as is called for in the moment.

This is awesome news! You guys are great!

I'm sure plenty of people with small / medium sized sites will benefit from the $5-$10 they'll save. I won't disagree with that.

But I would imagine my quote from Stackpath is about the same as what you pay them per domain, since my network is about 15gbps sustained.

"Typical GFY post" - my smallest site isn't even "typical" for GFY. :winkwink:

Lots of assumptions here. I guess you'll never know unless you engage me in a pricing conversation to compete for your business. MojoHost isn't stacked full of clients paying $5 per month. I know I can save you money on that 15 gigabit of CDN traffic! :winkwink:

Brad

Based on the condescending tone of your response to him, I'm sure he'd likely tell you to Go Fuck Yourself. :1orglaugh Good times!

Perhaps. I can lead people to water, but I can't make them drink.

It seems strange of me to assume that a hosting provider with 1200 adult customers such as MojoHost isn't able to obtain a vastly preferential rates with it's suppliers. Also, to suggest that we aren't able to deliver a tremendous value proposition to our customers of all sizes large and small, is actually what seems a bit condescending.

I'm always thrilled to do well for our clients. Delivering thoughtful solutions and tremendous savings is how we have become the most widely used adult web host.

Completely unique to the marketplace, we also don't present clients with the contractual requirements that our direct adult hosting competitors or our suppliers (CDNs, facilities, bandwidth providers) require. We don't do this because we are the only company in the landscape with happy enough customers the last 20 years to retain it's customer base in an always changing landscape. We do that with #goodmojo in our client care.

Brad

Yeah, I've always viewed Brad in a pretty negative light. :thumbsup

We use mojo shield and are very happy with it. I couldn't tell you if it's $5 cheaper or more expensive, I can tell you that Mojo's support in getting it set up and configured saved time, money and headache.

No you can't. :thumbsup

I don't host with any of your direct competitors for my money sites. I'm probably one of the smallest clients on my host and for good reason, I figured out pretty quickly that being one of your providers biggest clients by traffic (if not the biggest) is a pretty bad business plan for myself. I don't really want to be the guinea pig - sounds expensive. :2 cents:

I don't have any contractual obligations either. So that's not really unique at all - save your double speak for the guys who are gonna put 45 "money sites" on one machine. :thumbsup

I've used many of the existing DDOS/WAF products in the marketplace - at scale.

Neustar was $2k/mo just to be able to use their NOT always-on solution. They charged me $8k every time I wanted to turn it on, which I believe was for 48-72 hours.

Incapsula was an always-on service, which was more affordable, but their strategy seemed to be to bring us in at a good price and then slowly over time keep increasing rates. Eventually there was a huge influx of bandwidth shortly before our renewal (which to this day appears to have been caused by Incapsula themselves). They demanded we increase our package to the next highest, which was ridiculously cost prohibitive.

CloudFlare was similarly priced to Incapsula. I like my friends over there but we haven't been able to do business yet.

MojoShield bills us a fraction of what any of these solutions cost. The solution is comparable and there's virtually no way I could have sourced the price myself. Its the same as our bandwidth with MojoCDN .. we have saved so much money with MojoCDN I could buy everyone in this thread a new car with the savings. Not joking.

The rates Mojo can charge are based on big clients making it more affordable for the little guys, and he extends those prices to everyone.

Brad shoots himself in the foot to give customers big savings. I deal with him because its cheaper than going direct pretty much every time and I have someone to help me when I need.

It sounds to me like you spent a lot of money on companies that notoriously charge a lot for services others offer cheaper, then "got a deal" from Brad and think it's the best on the market.

You're probably his biggest client - I bet he does give you a great CDN deal - you are probably a big reason why he was able to leverage a better price / commit from Stackpath. I'm fairly confident that you could get a better price elsewhere, though, because scale matters - and even in adult - Brad isn't the big dick hosting provider. Not even close, if we're talking purely data transmitted. There's at least two who are light years bigger. And there's probably a reason why the ad networks who are much larger than you host elsewhere. :winkwink:

As far as "passing on savings bc so many big clients (lol)": https://cs.mojohost.com/cart.php?gid=27 The overage listed there is quite a bit more expensive than my overage. So much so that I could probably buy you a new car if I were to switch from Mojo to my current provider. I just added the biggest package to cart to see price - $2k for 200,000GB - so in about 5 days on just ONE site, I'd hit that cap then be spending a small fortune in overage by the end of the month. Just a very rough guess, but probably in the neighborhood of $15-20k in overages - for one site.

Or do you mean to tell me he doesn't pass on savings to small clients / "shoot himself in the foot" and you're just kissing your buddy's ass? :upsidedow

It brings me great joy that Brad scrambled on Skype / SMS / whatever to get people to come in here and kiss his ass. :1orglaugh:1orglaugh:1orglaugh

Lemme know if you got any more brain busters. I'm here all day.

"Brain busters"? I shared my story.

I believe you when you say you'll be here all day.

I hope one day you find something to make you happy in your life.

:1orglaugh:1orglaugh:1orglaugh

I'm perfectly happy, my guy. I just have no issue calling you dorky bros out on your bullshit. :thumbsup

It all really depends on what you are looking to get out of the service (use case) and if you think you can set them up on your own without issue.

There are free services like cloudflare free service level offering that may fit some use cases. - Easy to setup, can cause some site to have issues if not setup right, low end price options are limited. Support on free is meh, paid is normally good. If you dont know what you are doing setup can be a pain.

As suggested you can go direct to stackpath, but also as suggested if you are unsure of the setup and possible trouble shooting then you may want to have mojo set it up for you. pro con is do you want to set it up and do any possible trouble shooting etc..

Sucuri is also an option, but they have been weak in the past for things like detecting malware that is triggered by geos outside of N.America. Support can be hit an miss.

If you are setting up for DDOS protection and you go with CF.. remember to change your IP or block direct ip.. Protecting your domain is pointless if your IP history can be found and targeted.

No idea if I use mojoshield or not, but I do know that I use mojocdn, which makes we wish that I didn't.

Lol, that's kind of contraintuitive what "cdn" should do.