LEVIATHAN
Free TrialGet license $5
ProductPricingDocsAbyssLinkChangelogSecurityFree TrialRequest a license · $5

Stop the flood at the edge.

Leviathan is a BungeeCord and Velocity fork that puts the anti-bot gate inside the proxy — before a username reaches your world, and without giving a jar control of your host.

Premium · US$5per licenseFree Trial available
Request a Premium license Run the Free Trial
BungeeCord + VelocityJDK 17 / 25Fail-openNo host takeover
LEVIATHAN / EDGE CONSOLESIMULATION
normal admission
Gate held.The proxy is admitting verified players and watching the edge.
14new connections / s
12 admitted
01THROTTLEPASS
02VERIFYTRUST
03FRAMEGUARDDETACHED
04BACKENDRECEIVING
[ok] verified IP inside trust window · forwarding to backend
[watch] 14 new connections · 0 over the attack trigger
scenario simulation · values illustrative · not live telemetry
Release1.3 · Free Trial + Premium
PlatformsBungeeCord · Velocity
GateIn-proxy Netty pipeline
LicenseUS$5 · per license

The first packets decide the rest.

Most anti-bot stacks wait for a plugin or a backend event. Leviathan acts earlier: on the socket, the handshake, and the brief login window — before a world is allowed to spend a tick on the connection.

TCP accept

Reject at accept

Sees The socket exists. No username, no UUID, no backend.

Does Throttle by IP and /24, reject malformed handshakes, read a Linux socket fingerprint.

Leviathan owns this
Handshake

Bound the handshake

Sees Hostname, protocol, next state, frame sizes.

Does FrameGuard enforces pre-login packet/byte ceilings and a login deadline.

Leviathan owns this
Verification

Earn the name

Sees A name and a reconnect attempt.

Does Username rules, name-flood windows, the reconnect challenge, reputation, optional GeoIP/ASN.

Leviathan owns this
Backend

Hand off clean

Sees A verified connection and the server address.

Does The normal BungeeCord or Velocity path. The flood has already been turned away.

Your world owns this

Eight gates. One process boundary.

The engine is compiled into the proxy, not bolted on as a plugin. Each layer runs where it can see the traffic, and the cheap checks run first.

Every control is in-proxy. No root, no iptables, no host package installs.

Connection throttle

no username needed

Per-IP windows, a proxy-wide login cap, subnet limiting, and malformed-handshake rejection run on TCP accept and the handshake — before a username exists.

Reconnect challenge

earned trust

A fresh IP is disconnected once and must come back inside a bounded window. Fire-and-forget bots never pass; earned trust is cached for the configured duration.

FrameGuard

pre-login only

A per-connection Netty handler enforces packets per second, login byte ceilings, per-tick bursts, and a login deadline. It detaches when the connection is verified.

Socket fingerprint

Linux · no-op elsewhere

Opt-in on Linux epoll, Leviathan can read kernel TCP metadata before the protocol starts. Cheap raw-socket bots advertise a stack that does not look like a real client.

Reputation

persistent + decaying

Every failed check adds weighted points to the source IP. Scores decay; crossing the threshold auto-blacklists. This catches polite bots that stay under each single window.

GeoIP / ASN / VPN

offline first

Operator-supplied MaxMind country and ASN blocks cost no request budget. Optional HTTPS reputation lookups run asynchronously, are cached, and can be gated to attack mode.

Blacklist + alerts

async webhooks

Manual and automatic IP blacklists survive restarts. Discord-compatible webhooks fire on attack start and end without blocking a login.

Attack mode

bounded hardening

When new connections cross the trigger, the proxy hardens verification and enables the expensive checks. It clears after the configured calm cooldown.

The edge has a control plane.

Premium is not a stronger gate. It is the same protection engine with a managed entitlement, a fleet heartbeat, and the AbyssLink control plane behind it.

Request a Premium license
Managed entitlementIncluded

A Spiky license, server ID, fingerprint, and Ed25519-signed validation payload.

Fleet heartbeatIncluded

The panel sees hostname, IP, version, region, and the last heartbeat.

Kill and restoreIncluded

A license kill or product kill lands on the next 60-second revalidation window.

AbyssLinkIncluded

The native backend-initiated control plane is entitlement-gated to Premium.

Private distributionIncluded

The Premium BungeeCord or Velocity distribution is delivered through the private release process.

Same protection coreIncluded

The anti-bot engine is not reduced in Free Trial. Premium buys the managed control plane, not a weaker free gate.

CONTROL PLANE / ABYSSLINKPREMIUM
Backend nodemTLS client
client certificate + pinned leaf
AbyssLink listenerprivate bind
capability intersection · heartbeat
Proxy edgegameplay path
no handlers installed in the game pipeline
Spiky entitlement60 s revalidation
AbyssLink v1 is a control plane, not remote game administration. Live cross-fork gameplay ping through a production proxy is not demonstrated. mTLS interop with SourbyCraft: 16/16 checks.

Five dollars. The edge included.

One Premium license at US$5. The Free Trial is not a countdown or a crippled build; it is the same public protection core without the managed entitlement.

Premium licenseOne tier
$5per license

A license request goes through the studio contact form. You will not be dropped into a card form that pretends a manual delivery is instant.

Request a Premium license Download Free Trial

A status line, not a promise.

Operators get one place to read the edge: attack state, current and peak connections, trusted and pending IPs, blacklist size, and the anti-VPN cache.

Fail-open
A license outage or rejected entitlement never stops the core gate. Protection keeps running.
No host mutation
No sudo, firewall rule, package install, or persistent host state survives the JVM.
Bounded
Small versioned persistence, async webhooks, and HTTPS-only reputation calls.
example output · values illustrative
> leviathan status
Edition: Premium
under-attack: false
cps: 4
peak: 38
trusted: 41
pending: 0
blacklist size: 12
tracked IPs: 63
anti-vpn cache: 0
abysslink: 2 nodes · 1 up
Attack modetrigger 60 cps
Premium revalidation60 s default
AbyssLinkPremium only

Read the chart before you sail.

Install, tune the gate, read the status line, and understand exactly what Premium adds. The manual is written for the fork you can actually download.

Getting started

Choose a proxy, verify the jar, and boot it as the proxy.

Open

Configuration

Throttle, verification, FrameGuard, reputation, and attack mode.

Open

Operations

Commands, status fields, GeoIP, webhooks, and recovery.

Open

Premium licensing

Spiky entitlement, 60-second revalidation, kill and restore.

Open

AbyssLink

The Premium-only backend control plane and its current limit.

Open

Security model

Fail-open, no host takeover, and the boundary of the claim.

Open

The flood is not your world’s problem.

Put the gate in the proxy. Keep the host clean. Choose the Free Trial or the US$5 Premium license when you need the managed control plane.

Request a Premium license Free Trial jars
Talk to the studio