despacito.bot

What It Is

Despacito is a vendor-neutral rate-limiting protocol led by Relaycorp, designed to mitigate application-layer DDoS attacks and intended to be submitted as an Internet Draft. It targets Layer 7 reverse proxies or CDNs, rather than being a traditional cloud protection product that users can purchase directly. The website also makes clear that the project is still in progress and is primarily being used to gather feedback.

Core Capabilities

The core idea is for the origin server to provide the proxy with client information and origin status, so the proxy does not have to rely solely on IP reputation and can instead apply rate limits based on client identity. The protocol introduces an authorization service that authenticates clients and issues short-lived certificates, which clients must include in subsequent requests. The proxy can make decisions based on authentication method, user or client ID, completed cryptographic challenges, human verification, client software trustworthiness, request quotas, origin capacity, and threat level. Possible outcomes include forwarding the request, requiring re-authorization, returning a 40X denial response, or disconnecting the TCP connection when strong malicious signals are present.

Deployment, Integration, and Management

Despacito can be enabled continuously, or activated on demand during attacks, high origin load, or spikes in legitimate traffic. The authorization service can be provided either by the origin itself or by a third party. The text also notes that origin capacity can be supplied by the runtime platform, such as Kubernetes HorizontalPodAutoscaler or Google Cloud Run. This suggests that the design emphasizes coordination among cloud-native scaling systems, CDNs/reverse proxies, and origin servers. However, the website does not disclose any specific proxy implementation, control panel, alerting, log analysis, or operational workflows.

Pricing and Compliance

There is currently no information on pricing, payment methods, SLA, or commercial support. No compliance certifications such as SOC 2 or ISO 27001 are mentioned either. That said, its working draft underwent a security assessment by Radically Open Security in April 2025, supported by the Open Technology Fund, which provides some credibility for an early-stage protocol.

Pros, Cons, and Who It’s For

Its strengths are a clear concept and the ability to complement traditional IP-based rate limiting, especially by reducing false positives in NAT, shared-egress, and proxy-network environments. It can also adapt dynamically based on origin capacity and threat level. The drawbacks are limited maturity: it remains closer to a protocol draft, with no visible production deployment cases, performance benchmarks, or commercial guarantees. It is best suited for CDN providers, reverse proxy vendors, security research teams, and large service operators capable of participating in protocol experiments.

Access from China and Alternatives

Access status from mainland China cannot be determined from the text, and payment methods are not disclosed. If an organization needs an immediately deployable solution, it should first evaluate mature options such as Cloudflare, AWS Shield, Akamai, Fastly, or domestic services such as Tencent Cloud DDoS Protection and Alibaba Cloud Anti-DDoS Premium.