Black Week from 23 Nov.: VPS specials that will not come back afterwards
DE EN
Customer area

Attacks stay out. Your visitors get in.

We operate our network and DDoS protection entirely ourselves: the AVORO DDoS Protection. It sorts out malicious traffic before it reaches your server. Real requests keep getting through.

Under Attack? How it works
> 500attacks per day on our network
99.95 %of them mitigated automatically
5.1 Tbit/slargest filtered attack 2026
99.98 %availability of our network, annual average

Which protection suits you?

The AVORO DDoS Protection comes in two tiers. Every server with us has the basic protection. If a single application is attacked on purpose, it needs a finer filter.

Included

Basic Protection

Part of every product we offer and filters typical attacks automatically. You don't need to set anything up.

  • Included in every product
  • Protection against typical standard attacks
  • No custom filter rules
Already active
On request

zero-lag Protection

For targeted attacks, for example on your game server or shop. Traffic to your IP runs through fine filters that match your application exactly. The filter also checks the traffic leaving your server, so it recognizes even more precisely what is real.

  • The right filter for your application
  • Looks at incoming and outgoing traffic
  • Detects your services automatically
  • Many ready-made profiles, new ones on request
Request

Ready-made filter profiles, for example for

  • TeamSpeak
  • Minecraft
  • GTA
  • Rage:MP
  • alt:V
  • Counter-Strike
  • ARK
  • DayZ
  • Valheim
  • Webserver
  • WireGuard
  • OpenVPN

And many more. Your service is missing? Let us know and we will create the profile.

DDoS Manager

For an extra fee you set filter profiles and thresholds yourself.

Your own networks and AS

We also protect your own IP prefixes and AS numbers via BGP.

How it works, simply explained

Instead of blocking everything during an attack, we separate the attack from real visitors. This happens in three steps.

  1. Obvious junk is dropped right away

    Clearly invalid traffic, for example amplification attacks, never even reaches our routers.

  2. The rest is checked closely

    The protection detects which service runs on your IP and uses the matching filter for it.

  3. Only clean traffic reaches you

    Real requests from your visitors and players keep reaching your server.

For tech fans

Real-time detection and mitigation
We have consistently optimised our DDoS protection architecture for operations based on our own experience. Potentially at-risk traffic is permanently routed through the DDoS protection. The advantage: mitigation does not have to be provisioned or switched on only when an attack starts, it is already in the data path. As soon as defined thresholds are reached, filtering kicks in automatically and without any extra analysis or switchover delay. Outbound connections from your servers are taken into account as well. This even stops attacks that conventional solutions without symmetric filtering cannot detect at all or only poorly.

zero-lag: layered defense
Clearly invalid traffic, for example amplification or reflection attacks or UDP traffic to TCP ports, never reaches our routers, because upstream infrastructure filters it out or limits it to a minimum. Our routers apply further pre-filtering and steer the remaining traffic to our own scrubbing center. There all traffic is filtered in detail and only legitimate traffic is forwarded to the target. The scrubbing systems also generate filter rules automatically (BGP Flowspec), which routers and carriers use for additional pre-filtering.

Service scanning and automatic filter profiles
The protection automatically recognises known services on a protected IP through service scanning. Based on the detected protocol or application, the matching filter profiles and thresholds are applied without you having to assign them. Protection stays aligned with the services you actually run and adapts when that changes.

DDoS Manager
For an extra fee you configure your DDoS protection yourself with our DDoS Manager. You adjust filter profiles and thresholds to your applications and can also enable or disable the DDoS protection.

BYOIP, BYOAS and BGP protection
We can also protect your own IP prefixes and AS numbers (BYOIP/BYOAS) via BGP. This requires the DDoS Manager, because filter profiles and thresholds have to be aligned individually with your infrastructure. In addition to the DDoS Manager fee, there are charges for the BGP connection.

Under Attack?

Write to us. We will look at the attack and tell you which protection helps.

Report it now

Frequently asked questions

We answer your questions before you buy. Your question is not listed? Just write to us.

Contact us

Am I protected automatically?
Yes. Every product at AVORO is covered by Basic Protection, which filters common attacks automatically. You do not have to set anything up and pay nothing extra.

When do I need zero-lag Protection?
When a single application is targeted, such as your game server, a shop or an API. Traffic to your IP then runs through fine filters that match your service exactly. For Instant and dedicated servers you add it when ordering; for VPS and anything else, get in touch.

Do you also filter outgoing traffic?
With zero-lag Protection, yes. The filter also checks the traffic leaving your server, so it recognizes even more precisely what is real.

How large an attack can you handle?
Our network sees more than 500 attacks every day, and we mitigate 99.95 % of them automatically. The largest attack we have filtered so far reached 5.1 Tbit/s.

How is my TeamSpeak server protected?
Our TeamSpeak servers have DDoS protection tuned for TeamSpeak, at no extra cost. You do not need additional zero-lag Protection.

What is a DDoS attack?
In a DDoS attack (Distributed Denial of Service), many hijacked devices overload a server or application at the same time until it slows down or fails. Attackers use huge volumes of data, weaknesses in network protocols or expensive requests to individual applications.