DDoS Protection

Protecting your services against DDoS attacks is comparable to essential insurance, because the question is not if, but rather when, you will be the victim of a DDoS attack. With zero-lag, we combine several proprietary technologies with powerful network hardware from leading manufacturers in order to be able to meet every customer requirement, from protecting individual servers and applications to entire networks and data centers.

After a decade of successful DDoS defense, we know:

Criminal prosecution of DDoS attacks is only possible in rare cases — and even in these cases, it is of absolutely no use to immediately correct the disruption of your services. Only DDoS protection provided by experienced experts, which can be individually adjusted to harmful and legitimate data traffic, helps against DDoS attacks.

Effective DDoS Protection: Our Clear Objective

While many providers treat DDoS protection primarily as a fallback measure to protect their own network, often blocking legitimate traffic as well during an attack, our approach is clear: the attacked target application should remain reachable. That is why we filter out malicious traffic almost entirely before it ever reaches your application. To achieve this, we rely exclusively on our own IP backbone and filtering infrastructure, ensuring that we never act as a reseller or depend on third-party suppliers at any point.

Get in touch with an expert

Figures, data and facts

> 6 Tbps

External connection of our network

> 500

daily DDoS attacks on our network

99.95%

automatically mitigated daily DDoS attacks

2.2 Tbps

largest filtered DDoS attack on dataforest customers 2026

DDoS protection products

We can adapt any component to your request, simply ask us for the desired configuration.

Basic Protection

All products operated within our infrastructure include Basic Protection against DDoS attacks. It provides baseline protection against standard attacks but, unlike the paid options, does not allow any customization of the filters and no symmetric filtering.

Contact us now

zero-lag Protection

For many applications, we offer tailored zero-lag Protection. In the event of an attack, traffic to a specific IP is redirected through our granular DDoS protection infrastructure within a very short time. This allows even complex attacks to be filtered precisely while largely eliminating so-called "bypasses." Additional Protection configurations and further templates are also available on request.

TeamSpeak
GTA
Webserver
Hurtworld
Counter-Strike
Half-Life
MuOnline
SCP: Secret Laboratory
alt:V
Minecraft
Arma
OpenVPN
WireGuard
RDP (Remote Desktop)
Mumble
DayZ
DDNet
Rage:MP
MTA: SA
Conan Exiles
ARK
Unreal Tournament 99
Valheim
Sons of the Forest

Contact us now

zero-lag Protection Pro

zero-lag Protection Pro extends our zero-lag Protection with symmetric analysis of both inbound and outbound traffic. This allows legitimate traffic to be distinguished from malicious traffic with even greater precision. It is particularly beneficial for complex protocols, individual traffic profiles, and demanding applications with high requirements for availability and filtering accuracy.

TeamSpeak
GTA
Webserver
Hurtworld
Counter-Strike
Half-Life
MuOnline
SCP: Secret Laboratory
alt:V
Minecraft
Arma
OpenVPN
WireGuard
RDP (Remote Desktop)
Mumble
DayZ
DDNet
Rage:MP
MTA: SA
Conan Exiles
ARK
Unreal Tournament 99
Valheim
Sons of the Forest

Contact us now

How our DDoS protection works

Unlike many competitors, we rely on a DDoS protection architecture that we have consistently optimized for operational use based on our own expertise. Potentially at-risk traffic is permanently routed through the DDoS protection layer. The key advantage is that mitigation mechanisms do not need to be provisioned or activated only when an attack occurs; instead, they are already present in the data path. As soon as defined thresholds are reached, filtering is applied automatically and without any additional upstream analysis or switchover delay. Outbound connections initiated by customer servers are also taken into account, allowing even those attacks to be effectively mitigated that conventional market solutions without symmetric filtering cannot detect at all or can only detect inadequately.

Our defense against DDoS attacks works on multiple levels. Clearly invalid traffic—for example amplification/reflection attacks or UDP traffic to TCP ports—never reaches our routers, because upstream infrastructure filters it out or limits it to a minimum. Our routers apply further pre-filtering and steer remaining traffic to our own scrubbing center, which performs granular filtering of all traffic and only forwards legitimate traffic to the target. The scrubbing systems also generate automated filter rules (BGP Flowspec) used by routers and carriers for additional pre-filtering.

Our protection automatically recognizes known services on a protected IP through service scanning. Based on the detected protocol or application, the appropriate filter profiles and thresholds are applied without you having to assign them manually. Protection stays aligned with the services you actually run and adapts when the service mix on that IP changes.

Against an additional fee, you can configure your DDoS protection to suit your needs with our DDoS Manager. You can adjust the filter profiles and thresholds tailored to your applications. Additionally, you can enable or disable DDoS protection.

Protection for your own IP prefixes and AS numbers (BYOIP/BYOAS) via BGP can also be provided. In this case, the DDoS Manager is required, as filtering profiles and thresholds must be individually aligned with your infrastructure. In addition to the surcharge for the DDoS Manager, separate BGP connectivity charges will apply.

How our DDoS protection works

Our DDoS protection architecture combines multi-layered filtering mechanisms, automated service detection through service scanning, and our many years of expertise into a comprehensive protection concept.

Get in touch with an expert

DDoS Protection: A Success Story

Learn about our journey and developments in DDoS protection technology, which have made us leading experts in the industry.

2011

First DDoS attacks on our hosting services — and this at a time when DDoS protection is invaluable for medium-sized companies. Our passion for DDoS protection grew out of the initial need.

2015

The first vServer products with free DDoS protection, which is virtually not included anywhere at this time, are being released at a new location and are very popular on the vServer market.

2018

Our last host systems are moving to the new location — every customer now enjoys free DDoS protection regardless of the purchased product.

2024

Implementation of our new DDoS protection under the project name zero-lag, which allows us to eliminate final dependencies on individual market players and create an independent, redundant solution that offers maximum reliability and scalability.

More about us

FAQ

Everything you need to know about DDoS protection

Here you can find answers to frequently asked questions

A distributed denial of service (DDoS) attack is a malicious way to cripple a website or online service by overloading it with a massive amount of requests or traffic. Attackers use a network of compromised computers and devices known as a botnet to send requests at the same time. This flooding causes the target's servers, networks, or applications to become overloaded and either respond extremely slowly or completely fail. The goal of a DDoS attack is to affect the availability and performance of affected services, resulting in downtime and disruption for users.

DDoS attacks fall into several major categories. Volume-based attacks flood networks with massive traffic to deplete bandwidth. Protocol attacks exploit vulnerabilities in network protocols to burden servers or networks. Application-based attacks target specific applications by sending complex requests to overburden them. There are also combined attacks that mix different methods to overcome the defense mechanisms and cause extensive overloads.

All of our products are protected against DDoS attacks as standard. For customers with special requirements for individual filter rules, etc., we offer tailor-made anti-DDoS solutions. We operate our network and DDoS protection completely ourselves, so that we can adequately protect every new customer from attacks — regardless of the size, intensity and duration of the attacks.

Still have questions?

Our team of experts is available to provide you with further information.

Get in touch

Our strong partners

In order to guarantee you the best service, we also rely on the right partners.

euNetworks GmbH, based in Frankfurt am Main, owns and operates a dense fiber optic network in major Western European cities.

We benefit from direct networking of our locations with dark fiber from the euNetworks network.

Equinix operates the world's largest network of carrier-neutral data centers and Internet exchanges, interconnecting thousands of networks, clouds and providers.

Through our connection to Equinix, you benefit from excellent peering and particularly short paths to networks around the globe.

The Réseaux IP Européens Network Coordination Center is the registry responsible for assigning IP networks and AS numbers for Europe, the Middle East and Central Asia.

We only use IP addresses delegated directly to us by RIPE and can therefore offer maximum flexibility for our infrastructure and your services.

maincubes one GmbH is a data center operator headquartered in Frankfurt am Main and hosts many customers from all over the world in its data centers.

Thanks to the innovative and efficient design of the FRA01 data center, we not only benefit from the redundant design but also from the particularly energy-efficient operation.

Interxion is a provider of carrier-neutral data center colocation services. The company currently operates 53 data centers in eleven European countries, 13 of which are in Frankfurt am Main.

Our second location offers you further advantages, including the outsourcing of individual services or better peering to other networks!

Enterprise hardware, premium network, 100% made in Germany

First-class infrastructure should be a given – but often isn't: with us, "the cloud" runs on enterprise servers from renowned manufacturers and is redundantly connected to power and network. Our operations team takes immediate care of any anomalies around the clock.

More about our network

DDoS Protection

After a decade of successful DDoS defense, we know:

Effective DDoS Protection: Our Clear Objective

Figures, data and facts