DDoS Attack Response

These try to saturate your bandwidth with sheer volume, often using amplification through misconfigured DNS, NTP or memcached servers to turn a small request into a huge response. The defence is to filter and absorb the volume upstream, at the network edge or through a provider’s scrubbing capacity, before it ever reaches your pipe.

These target the plumbing of the connection itself, exhausting resources on firewalls, load balancers or servers. A SYN flood that leaves half-open connections is the classic example. Mitigation tightens connection handling and drops malformed or abusive traffic at the edge rather than letting it tie up your infrastructure.

The sneakiest floods look like real traffic. A layer-7 attack sends requests that are individually valid but collectively crushing, hitting an expensive search or login endpoint until the application falls over. These need behavioural filtering and rate-limiting that can tell a bot storm from a genuine traffic spike, which is where a well-tuned WAF earns its place.

We confirm you are under attack rather than experiencing a legitimate surge, identify the attack type and the targeted service, and measure the volume and pattern. This tells us where to filter and how aggressive to be without cutting off real customers.

We put filtering in place fast: activating or tuning your provider’s scrubbing, tightening rate limits, blocking the abusive sources and patterns, and steering traffic through a CDN or reverse proxy that can absorb the load. The aim is to get you serving real users again while the flood is still running.

As the attacker shifts tactics, so do we. We watch for the flood moving to a new vector or target and adjust the rules to keep pace. Many DDoS campaigns come in waves, and holding the line means expecting the next one rather than declaring victory too early.

Once traffic normalises, we bring any degraded services fully back and confirm performance is stable under normal load. We check that nothing was quietly broken by the emergency rules, so you are not left with legitimate users blocked by a filter that outlived the attack.

We turn the temporary defence into a standing one: always-on edge protection, sensible rate limits, an autoscaling or overflow plan, and a runbook so the next attack is handled in minutes. DDoS attack prevention is mostly about having this in place before, not scrambling during.

While mitigating the flood, we keep an eye on authentication logs, admin access and data egress for signs that the attack is a distraction. If the traffic storm coincides with unusual logins or outbound transfers, the DDoS may be the smaller half of the incident, and we escalate accordingly.

Some attacks arrive with a ransom note demanding payment to stop the flood. Paying rarely ends it and often marks you as a soft target for the next crew. We help you hold the line technically instead, so the decision is not made under duress.

Routing your traffic through a CDN or scrubbing service that can absorb large volumes moves the fight away from your own servers. Configured well, it filters the obvious junk automatically and only escalates to a human when something unusual appears. It also gives your own servers room to breathe, because most of the abusive load never reaches them and your capacity is spent on paying customers instead of a botnet.

Rate limits, caching, autoscaling and graceful degradation let your service shed load without falling over entirely. A site that serves a lightweight cached page under extreme load is still serving; one that tries to render everything for everyone simply dies.

A tested runbook

We leave you with a written response plan naming who does what, which providers to call, and which controls to flip. DDoS attack prevention and detection work best when the first response is a rehearsed routine, not an improvisation.

A written summary of the attack: its type and scale, the vectors used, the sources where we could identify them, what we filtered, and how long each stage of the response took. It is useful for your board, your insurer and, if you choose to pursue it, law enforcement.

A prioritised set of changes to your edge, your application and your monitoring so an attack of the same shape is caught and absorbed automatically next time. Where you take a managed protection plan, we implement and maintain these for you.