• Spain’s largest internet exchange point deploys Nokia’s AI-driven DDoS security to detect and mitigate attacks that cross its Barcelona- and Madrid-based exchange platform within seconds.
• A new optional DDoS protection service is available to more than 200 national and international networks connected to ESpanix, which together serve the majority of internet end users in Spain.
• In-network protection keeps Spanish internet traffic — and its security — inside Spain, supporting data sovereignty and European regulatory expectations.

Nokia  announced that ESpanix, Spain’s largest internet exchange point, has selected and deployed Nokia Deepfield Defender to protect its exchange platform and connected networks against distributed denial-of-service attacks. The deployment enables ESpanix to offer DDoS protection as a new, optional value-added service to the more than 200 national and international networks that exchange traffic at the ESpanix Node and together serve the vast majority of internet end users in Spain.

DDoS attacks continue to grow in size, frequency, and sophistication, with massive botnets of compromised IoT devices and weaponized residential proxies driving hyper-volumetric and application-layer attacks against networks, services, and end users. As the central crossroads of the Spanish internet, the ESpanix Node occupies a strategic position: stopping attack traffic at the exchange prevents it from ever reaching the networks — and the businesses, public services, and consumers — behind its ports.

“DDoS attacks remain a primary threat to our connected networks daily. Integrating a proactive detection and mitigation solution into our infrastructure represents a significant step forward in ESpanix’s ongoing commitment to maximizing security across our service portfolio. Leveraging the exceptional detection granularity of Nokia Deepfield, we can substantially reduce the impact of DDoS events by isolating and removing only unwanted traffic. Crucially, this protection is delivered entirely within our network and within Spain, across the six datacentres in Madrid and Barcelona where we connect with our members. This ensures that local traffic remains local, eliminating any need for detours through third-party scrubbing infrastructure and thereby guaranteeing strict data sovereignty. By unifying these capabilities, we have made DDoS protection far simpler to implement and operate, ensuring that our end users need no specific technical expertise to enjoy robust, seamless defense. This new service enhances the value of connecting to the ESpanix Node and introduces a new dimension to the services we offer our members,” said Javier Achirica, CTO, ESpanix.

“Internet exchanges are critical infrastructure — and for Spain, ESpanix is where the national internet comes together, which also makes it the smartest place to stop DDoS attacks. With Deepfield Defender, ESpanix detects and removes attack traffic in seconds, directly in the network and inside the country. This deployment shows how internet exchanges across Europe can turn security into stronger resilience for their members and a new source of value at the same time,” said Jeff Smith, Vice President and General Manager, Nokia Deepfield.

Nokia Deepfield Defender combines AI-driven, big data analytics of network telemetry with Deepfield Secure Genome®, Nokia’s proprietary, cloud-based data feed that tracks the security context of the internet. Defender detects all types of DDoS attacks in seconds and drives automated, network-based mitigation with a very high degree of granularity — surgically removing only unwanted traffic while legitimate packets keep flowing. By unifying detection and mitigation in the network itself, ESpanix avoids rerouting member traffic to external scrubbing centers: attacks are identified and removed where the traffic flows, keeping Spanish internet traffic and the responsibility for securing it within Spain.

The deployment extends a partnership that, in 2025, made ESpanix the first IXP in Spain to offer 400G connectivity to its customers, built on Nokia interconnect and service routers running over Nokia optical transport. With Deepfield Defender, ESpanix joins a growing group of leading European internet exchanges that use Nokia Deepfield to protect their members and to build new security services on top of their interconnection platforms. For exchanges, the deployment model has a multiplier effect: a single deployment at an exchange extends protection to every network that connects through it.

The new DDoS protection service is being introduced to the ESpanix community and the wider industry at upcoming events.