Where does the data for n'guard DDoS Intelligence come from?

The data comes from the public measurement data of Cloudflare Radar. n'guard prepares it for Swiss SMEs and puts it into context.

What should you do during an ongoing DDoS attack?

Inform your provider and, if you have one, your DDoS protection service, and secure attack patterns such as ports, protocols and source networks. Services that are not needed are switched off temporarily, and you should check whether the attack is serving as a diversion. The incident is reported to the BACS.

Do SMEs need DDoS protection?

According to n'guard, anyone who generates revenue or provides services over the internet, for example via a shop, portal, customer login or API, needs it. For purely internal systems, a clean firewall configuration without unnecessarily exposed services is usually enough.

Does DDoS Intelligence show absolute attack numbers for Switzerland?

No. The values are relative shares of the traffic measured by Cloudflare. Attacks against systems outside the Cloudflare network are not included.

How often is Switzerland hit by DDoS attacks?

The page shows Switzerland’s share of DDoS attack traffic measured worldwide and its ranking among the target countries, updated continuously. Politically motivated waves, for example around international conferences or votes, regularly lead to short-term attacks against authorities, banks and the media.

Where does the DDoS data come from?

From Cloudflare Radar, which evaluates attack traffic against the global Cloudflare network and makes it publicly available. The numbers are relative shares, not absolute attack numbers, and represent the traffic that Cloudflare sees.

DDoS Intelligence

ENEnglish

LiveUpdated hourly

DDoS Intelligence

Who is targeting Switzerland right now.

Q: What is a DDoS attack?

Many hijacked systems flood a service with requests or traffic at the same time until it can no longer be reached by genuine users. Network-level attacks (Layer 3/4) target bandwidth and network devices, while application-level attacks (Layer 7) target web servers and applications.

DDoS attacks targeting Switzerland and DACH at the network and application level: history, protocols, duration, affected industries and countries of origin. Updated hourly from public measurement data.

Rank Switzerland as target country (L3/4)

Share of global attack traffic

Rank at application layer (L7)

Network-layer attack traffic (layer 3/4)

Target: , relative to the maximum in the period

Application-layer attack requests (layer 7)

Target: , relative to the maximum in the period

Anatomy of attacks

How the attacks work.

Protocols (L3/4)

Share of attack traffic

Duration

How long attacks last

Bandwidth

Attack peaks

Sectors attacked

Target , network level

Application level: defense mechanisms

Like L7 attacks against were stopped

Geography

Origin and destinations worldwide.

The origin refers to the country of the attacking systems, usually hijacked servers and devices, not the location of the perpetrators.

Most Attacked Countries (L3/4)

Share of global attack traffic

Most common countries of origin (L3/4)

Share of global attack traffic

Most Attacked Countries (L7)

Proportion of requests rejected worldwide

Affected?

Everyone notices a DDoS. Nobody notices data leaving.

DDoS attacks are loud but rarely the real goal. They often serve as a diversion while credentials are abused or data is copied elsewhere. The free Dark Web & Exposure Check shows whether your domain is vulnerable to this.

Checks leaked credentials, open services, email security and attack surface in a minute.

Check your own domain

In simple words

What does the DDoS Intelligence show?

The n'guard DDoS Intelligence is a free, hourly updated evaluation of distributed denial of service attacks targeting Switzerland and DACH. It shows the history of attack traffic at the network level (Layer 3/4) and the attack requests at the application level (Layer 7), the protocols used, duration and bandwidth of the attacks, the affected industries and the origin and destination countries worldwide.

The basis is the public measurement data from Cloudflare Radar, which evaluates the attack traffic against the global Cloudflare network. n'guard prepares and classifies the data for Swiss SMEs: when is DDoS protection worthwhile, which systems are exposed, and what should be done in the event of an ongoing attack.

Limits of data

The values are relative shares of the traffic measured by Cloudflare, not absolute attack numbers for Switzerland. Attacks against systems outside the Cloudflare network are not included. The assignment to countries is based on the geolocation of the addresses involved.

FAQ

Answers on DDoS attacks.

What is a DDoS attack?

Many hijacked systems simultaneously flood a service with requests or traffic until it is no longer accessible to real users. Network level attacks (Layer 3/4) target bandwidth and network devices, while application level attacks (Layer 7) target web servers and applications with seemingly legitimate requests.

How often is Switzerland hit?

The rank and share above continually show it. Politically motivated waves, for example around international conferences, votes or expressions of solidarity, regularly lead to short-term attacks against authorities, banks, media and infrastructure.

What to do if a DDoS attack is in progress?

Inform your provider and, if you have one, your DDoS protection service; record the attack pattern (ports, protocols, source networks); temporarily switch off services you do not need; check in parallel whether the attack is a diversion (unusual logins, data leaving). Report the incident to BACS. n'guard supports the response.

Do SMBs need DDoS protection?

Yes, if you generate revenue or deliver services over the internet (shop, portal, customer login, API). Cloud-based protection in front of the web server is affordable today and quick to switch on. For purely internal systems, a clean firewall configuration without needlessly exposed services is usually enough.

Availability is part of security

Stay reachable when it matters.

n'guard assesses your exposure, configures DDoS protection and monitors in Managed SOC whether there is a second attack running behind the noise.

Get to know Managed SOC →Request advice