Every European DDoS protection service reviewed
Munich, Germany
Founded 2012
Enterprise pricing / Contact for quote
Demo on request
Best for: European enterprises, government agencies, critical infrastructure
Myra Security is the vendor on this list that most closely resembles a managed-service replacement for a NETSCOUT Arbor Cloud contract. It filters layers 3, 4 and 7 from cloud scrubbing centres in Germany, and adds a web application firewall, bot management, DNS security and a CDN in the same service. The category research records a 99.999% availability SLA, the strongest availability figure published by any vendor here.
Myra Security GmbH is registered in Munich (HRB 202428) and was founded in 2012.
According to the vendor, its platform meets all 37 BSI criteria for qualified DDoS mitigation, it holds ISO 27001 on the basis of BSI IT-Grundschutz and BSI C5 Type 2 attestation, and staff with access to customer systems work in Germany. The vendor also says it blocked more than 240 million malicious requests during a campaign against German financial institutions. Pricing is quote-based, with a calculator and proof-of-concept engagements instead of a self-serve plan.
What Myra Security does well
- BSI certified, with C5 Type 2 attestation named on the vendor pages
- Filters layers 3, 4 and 7 and bundles WAF, bot management and CDN
- Availability SLA of 99.999% published
- Hosted in Germany by staff who work under German employment law
- One contract instead of separate DDoS, WAF and CDN vendors
Where Myra Security falls short
- No list prices; a quote or calculator is required first
- Network smaller than the CDN-first vendors
- Costly for a small marketing site
- Sales process comes before any evaluation
Standout feature. Myra Security is the only vendor here that pairs a published 99.999% SLA with BSI C5 Type 2 attestation and a German-only workforce.
Frankfurt, Germany
Founded 2005
Enterprise pricing / Contact for quote
Demo on request
Best for: European enterprises needing advanced DDoS protection
Link11 puts machine-learning detection at the centre of its DDoS service and sells it from Frankfurt. According to the vendor, the platform runs 13 scrubbing centres, two security operation centres and more than 40 points of presence, in always-on mode, with mitigation starting within 0 to 10 seconds per attack vector. Onboarding is described as a DNS forwarding change, so no appliance or application change is needed.
Link11 GmbH was founded in 2005 and is registered in Frankfurt (HRB 106307). It is BSI-qualified as a DDoS provider for critical infrastructure in Germany and ISO 27001 certified. Commercially it is the most transparent German option: monthly euro plans with self-onboarding, and an attack flat rate that keeps the bill stable during a long campaign. The network DDoS page, capacity figures and patent claims could not be read during research, so none are repeated here.
What Link11 does well
- Detection by machine learning with always-on, zero-touch operation
- Attack flat rate and monthly plans in euro
- DNS-based onboarding without hardware
- BSI-qualified for critical-infrastructure DDoS protection
- WAF, bot management, DNS protection and secure CDN in the same platform
Where Link11 falls short
- Enterprise tiers priced by traffic, domains and modules
- Capacity and scrubbing locations were not readable on the vendor site
- Smaller global footprint than Cloudflare or Akamai
- Mitigation times are vendor figures, not an SLA
Standout feature. Link11 is the only vendor here that offers an attack flat rate, so the invoice does not grow with the length of the attack.
London, United Kingdom
Enterprise, appliance-based pricing on request
Demo on request
Best for: ISPs, hosting providers and carriers that run their own network
Corero Network Security sells DDoS mitigation as hardware and virtual appliances instead of a cloud service. SmartWall units sit in the data path, so malicious packets can be dropped within seconds of the pattern appearing, without redirecting traffic to a scrubbing centre. The customers are ISPs, hosting companies and carriers that protect their own network and, through it, everyone connected behind.
The parent is Corero Network Security plc, listed in London, and its operating UK subsidiary (company number 04047090) was incorporated in 2000 as Top Layer Networks Limited. A US subsidiary in Marlborough, Massachusetts also exists, so read the order form for the contracting entity. The United Kingdom is outside the EEA and relies on an adequacy decision. Pricing is appliance-based and quoted per deployment, which means equipment or a managed contract, not a monthly signup.
What Corero Network Security does well
- Mitigation happens in the data path, with no reroute step
- Physical and virtual SmartWall options
- Fits ISP, hosting and carrier networks
- Listed UK company with traceable registration
- Direct counterpart to on-premises Arbor deployments
Where Corero Network Security falls short
- Price only on request, tied to hardware or a service contract
- Not meant for a single website
- UK jurisdiction rests on an adequacy decision
- A US group subsidiary exists
Standout feature. Corero Network Security is the only entry that moves the filter onto your own network edge as an appliance, which makes it the on-premises counterpart to the Arbor range.
Luxembourg
Founded 2014
Free tier available, paid from €25/month
Demo on request
Best for: Gaming, streaming and low-latency delivery with built-in DDoS filtering
Gcore sells DDoS protection from a Luxembourg base and prices it on clean traffic, not on attack volume. The category research lists 200+ Tbps of filtering capacity and a 99.99% uptime SLA, both vendor claims, and coverage of layers 3, 4 and 7. Because the same network also carries Gcore's CDN, edge computing, cloud VMs, DNS and load balancing, one account can cover delivery and protection.
Gcore S.A. is the Luxembourg company spun off from the gaming company Wargaming in 2014, with 180+ points of presence and gaming studios among the named uses. Prices on the DDoS page are in US dollars only, with plans from $275 per month according to the category research; the CDN plans on the tool page start at €25 per month. Certifications and the list of scrubbing locations are not named on the DDoS page.
What Gcore does well
- Clean-traffic billing means attack volume is not charged
- Filtering across layers 3, 4 and 7
- 180+ points of presence under one account
- Cloud, edge and DNS products next to the filtering
- EU entity in Luxembourg
Where Gcore falls short
- DDoS prices are in US dollars, not euro
- Entry plan above what a small site needs
- Certifications not named on the DDoS page
- Larger product surface to configure
Standout feature. Gcore charges for clean traffic that reaches the origin, so an attack does not enlarge the invoice.
Ljubljana, Slovenia
Founded 2015
Pay-as-you-go (from €0.01/GB)
Demo on request
Best for: Developers and small teams that want DDoS filtering added to a CDN account
Bunny.net adds DDoS filtering to its CDN through the Shield security plans, which is the lowest barrier to entry on this list. A free Shield tier and a 14-day trial exist, and the paid Advanced and Business plans are listed at $9.5 and $99. The documentation mentions 119 scrubbing centres, and the CDN network behind it has 110+ points of presence.
Bunny CDN d.o.o. is based in Ljubljana, Slovenia, was founded in 2015 and has grown without venture capital. Edge storage, Bunny Stream video, DNS and image optimisation share the account, so protection and delivery are bought together. Two vendor pages disagree on capacity (200 Tbps and 250 Tbps), and the mapping of included requests to plans was unclear, so neither figure is used here. Enterprise contracts and dedicated support are less developed than at Myra or Link11.
What Bunny.net does well
- Free Shield tier and a 14-day trial
- Plans from $9.5 and $99 listed publicly
- 119 scrubbing centres named in the documentation
- Shares an account with CDN, storage, video and DNS
- Slovenian entity, EU law for request logs
Where Bunny.net falls short
- Vendor pages give conflicting capacity figures
- Included-request limits per plan are hard to read
- No edge computing, unlike Gcore
- Thinner enterprise support than the German specialists
Standout feature. Bunny.net is the one vendor here where a developer can start protecting a site on a free tier, without a sales call.
Klagenfurt, Austria
Not published; see website
Demo on request
Best for: Anexia hosting customers who want filtering in the network path
Anexia filters attack traffic inside its own backbone, which is a different design from the cloud scrubbing services on this list. Baseline protection applies to every Anexia address, and a customer-specific DDoS Guard allows thresholds and mitigation profiles tuned to your normal traffic. During an attack, 5-tuple detection with CloudLog alerts reports source, destination, protocol and port.
Anexia Holding GmbH sits in Klagenfurt and is registered as FN 388403g. Its homepage states more than 100 company-owned locations in 70 countries and ISO 9001, 27001, 27701 and 14001 certification at group level. The DDoS page gives no capacity, SLA or price, and does not describe layer 7. The group also has an Anexia Inc. in New York, so the order form should show an Austrian or German GmbH as the contracting party.
What Anexia does well
- Filtering sits in the backbone that already carries your servers
- Baseline cover for all Anexia addresses
- Per-customer thresholds and mitigation profiles
- 5-tuple attack alerts through CloudLog
- ISO 27001 and 27701 stated for the group
Where Anexia falls short
- Capacity, SLA and price are missing from the DDoS page
- Layer 7 is not described
- Useful mostly for workloads hosted at Anexia
- Group includes a New York subsidiary
Standout feature. Anexia lets you set DDoS thresholds per customer inside the operator's own backbone, which most hosting bundles do not offer.
Roubaix, France
Founded 1999
Anti-DDoS included with every hosting product
Demo on request
Best for: Teams hosting on OVHcloud that want filtering without a separate contract
OVHcloud includes anti-DDoS filtering with every product it sells, and the category research records that it is unmetered and has no time limit on an attack. For a team already hosting at OVHcloud this means no second vendor and no invoice line for the protection. The anti-DDoS page gives no capacity figure, certification or scrubbing-centre count, so the strength of the filter has to be tested instead of read.
OVHcloud SAS was founded in Roubaix in 1999 and builds its own servers and data centres, 46 of them across four continents with most in Europe. SecNumCloud certification from ANSSI and founding membership of Gaia-X are listed on the tool page, though they are not tied to the anti-DDoS service. Only the footer of the anti-DDoS page names OVH SAS, so check the exact legal entity on the order form. There is no layer 7 offering described on that page.
What OVHcloud does well
- Anti-DDoS included with every hosting product
- Unmetered, with no limit on attack duration
- Own data centres and hardware in Europe
- SecNumCloud certification and Gaia-X membership at company level
- No separate vendor if compute is already there
Where OVHcloud falls short
- No capacity or scrubbing-centre figures on the page
- Covers only systems hosted at OVHcloud
- No layer 7 filtering described
- Certifications cover the company, not the anti-DDoS product
Standout feature. OVHcloud removes the DDoS line from the invoice entirely, because filtering is unmetered and bundled with each hosting product.
Sofia, Bulgaria
Not published; see website
Demo on request
Best for: Bulgarian and South-East European networks needing carrier-level filtering
Neterra offers DDoS protection as a carrier. The cloud platform filters layer 3 to layer 7 attacks, and the vendor says it can withstand attacks above 2 Tbps. Smart Blackholing is a second mechanism that detects and redirects attacks automatically, though the page gives no timing. Neterra says its network has more than 220 points of presence and lists its international, national and Sofia Metro Fiber networks as assets.
Neterra EOOD, named in the general terms, is headquartered in Sofia, Bulgaria (VAT BG121039370). The footer lists ISO 9001, 20000-1, 27001, 50001 and 22301 certificates and a PCI-DSS certificate dated December 2025; they apply to the company, not specifically to the DDoS service. No price, SLA, mitigation time or list of scrubbing locations is given. The service is strongest for traffic from Bulgaria and the Balkans, so a customer elsewhere should test routing and latency first.
What Neterra does well
- Layers 3 to 7 covered
- Platform capacity stated above 2 Tbps
- Smart Blackholing works automatically
- ISO 27001 and 22301 certificates at operator level
- Contracts with a Bulgarian EU entity
Where Neterra falls short
- No price, SLA or mitigation time published
- Scrubbing locations not listed
- Certificates may not cover the DDoS platform
- Regional strength, thinner English documentation
Standout feature. Neterra is the only entry on the list that combines carrier-level blackholing with filtering up to layer 7 from a Bulgarian operator.
Amsterdam, Netherlands
Standard included at no extra cost; Advanced for a small fee per IP (amount not stated); Customized and Always-on on request
Demo on request
Best for: Leaseweb server customers who want documented thresholds
Leaseweb documents its DDoS protection tier by tier in a knowledge-base article. Standard is the default, with a 5 Gbps threshold, 1,500k pps and 2 to 3 minutes to mitigate. Advanced raises the threshold to 10 Gbps with reporting and three detection profiles. Customized goes above 40 Gbps with 24x7x365 engineer support, and Always-on uses an in-line scrubbing device with a typical 45 to 90 seconds mitigation time and layer 7 filtering.
Leaseweb Netherlands B.V. in Amsterdam is the Dutch entity, although the brand sells through several national entities, each with its own contract. Standard and Advanced null route an IP above the threshold, which takes the target offline, and Standard cannot be disabled. Advanced is ordered per IP in the Customer Portal or API for a small fee that the article does not quantify. The product page could not be read, so everything here comes from the knowledge base.
What Leaseweb does well
- Thresholds in Gbps and pps published for every tier
- Standard tier applies by default at no charge
- In-line scrubbing with layer 7 filtering in Always-on
- Upgrade per IP through portal or API
- Dutch entity under EU law
Where Leaseweb falls short
- Lower tiers null route the IP once the threshold is exceeded
- Layer 7 needs the top tier
- Works only for Leaseweb-hosted systems
- Advanced fee is not stated
Standout feature. Leaseweb is the only hosting provider here that publishes numeric thresholds and mitigation times for each protection tier.
Gunzenhausen, Germany
Founded 1997
From €4.51/month (Cloud VPS)
Demo on request
Best for: Developers and businesses on Hetzner who need basic filtering at no charge
Hetzner includes automatic DDoS filtering for every hosting customer at no extra cost. Its tool page says the protection detects and mitigates volumetric attacks, and the DDoS page says it runs Arbor and Juniper hardware, the same Arbor line that NETSCOUT sells. The page gives no capacity figure and no SLA, so it works as a baseline for ordinary servers and not as an incident service.
Hetzner Online GmbH was founded in 1997 in Gunzenhausen and runs its own data centres in Nuremberg, Falkenstein and Helsinki. Cloud VPS plans start from €4.51 per month, and the tool page suggests combining Hetzner with a European CDN such as Bunny.net when stronger protection is needed. That pairing is sensible, since the Hetzner filter protects only servers inside its own network.
What Hetzner does well
- Filtering is free for all customers
- Detection and mitigation run automatically
- Arbor and Juniper hardware named on the DDoS page
- German company with data centres in Germany and Finland
- VPS plans from €4.51 per month
Where Hetzner falls short
- No capacity or SLA published
- Protects only Hetzner-hosted systems
- No layer 7 filtering described
- No attack-time support terms stated
Standout feature. Hetzner is the only vendor that states it uses Arbor hardware, so a switch from NETSCOUT can keep the same filtering technology under a German contract.
