DDoS protection

A distributed denial of service (DDoS) attack is a malicious way to cripple a website or online service by overloading it with a massive amount of requests or traffic. Attackers use a network of compromised computers and devices known as a botnet to send requests at the same time. This flooding causes the target's servers, networks, or applications to become overloaded and either respond extremely slowly or completely fail. The goal of a DDoS attack is to affect the availability and performance of affected services, resulting in downtime and disruption for users.

DDoS attacks fall into several major categories. Volume-based attacks flood networks with massive traffic to deplete bandwidth. Protocol attacks exploit vulnerabilities in network protocols to burden servers or networks. Application-based attacks target specific applications by sending complex requests to overburden them. There are also combined attacks that mix different methods to overcome the defense mechanisms and cause extensive overloads.

In contrast to many competitors, we rely on a combination of different solutions, all of which are maintained and developed within our company. What is unique about this is that potentially vulnerable traffic is constantly running through DDoS protection. Attack detection and filtering therefore takes place in real time, so that the time-to-mitigate (TTM) for normal attacks is 0 seconds and even complex attacks when individual thresholds are exceeded are filtered immediately, i.e. without delay through the necessary analysis and detection. Our technology also takes into account outbound connections made by customer servers and can thus filter attacks that standard solutions cannot or only insufficiently mitigate without so-called symmetric filtering.

All of our products are protected against DDoS attacks as standard. For customers with special requirements for individual filter rules, etc., we offer tailor-made anti-DDoS solutions. We operate our network and DDoS protection completely ourselves, so that we can adequately protect every new customer from attacks — regardless of the size, intensity and duration of the attacks.

Our fight against DDoS attacks works on multiple levels. Clearly invalid traffic, such as an amplification/reflection attack or UDP traffic on TCP ports, is already not reaching our routers, as this is filtered out by upstream infrastructure or limited to a minimum. Our routers carry out further pre-filtering measures and redirect the remaining traffic to our own scrubbing center, which carries out the granular filtering of all traffic and only allows valid traffic to pass through to the target system. The scrubbing systems also automatically create filter rules (BGP Flowspec), which are used by routers and carriers for further pre-filtering.