A mitigation service may be used to mitigate a network attack in a network including a group of mitigation devices. Datagrams, intended for a customer that is subject of a network attack, may be received by at least one of the mitigation devices based on an anycast address associated with the mitigation devices. Each of the mitigation devices is addressable via the anycast address. The received datagrams may be processed to remove malicious datagrams and leave legitimate datagrams. The legitimate datagrams may be forwarded to the customer via a tunnel configured between an address associated with the customer and the anycast address associated with the mitigation devices.