Can't access the site — connection timeout error, speed is super slow. Network admin said 'there's a DDoS attack'. What is this? How many minutes/hours does it last?
What can I do against DDoS? Firewall, CDN... what helps? Any immediate steps to take?
Does the police handle DDoS? Can they find the attacker? Does insurance cover it?
DDoS (Distributed Denial of Service): Traffic bombardment (overload) on a single server from thousands of bots/machines. Duration: minutes — weeks (typically 4-48 hours). Mitigation: 1) ISP notification (report to hosting provider, ISP-level filtering), 2) Firewall rate limiting (syn floods → threshold, connection limits), 3) CDN (Cloudflare, Akamai): anycast network, traffic scrubbing (legitimate traffic passes, bot traffic dropped), 4) DDoS mitigation service (subscription: $300-5000/month), 5) Application-level: CAPTCHA (filter bots), API rate limiting, geographic blocking (attack source). Diagnosis: NetFlow data (traffic pattern), sudden bandwidth spike, asymmetric response (connection fails but server is normal). Types: Volume-based (bandwidth consumption: UDP flood, DNS amplification), Protocol-based (TCP/IP vulnerability: SYN flood, fragmented packets), Application-based (HTTP flood, Slowloris). Insurance: integrate cyber insurance — business interruption coverage, ransom coverage (if extortion), DDoS mitigation service cost reimbursement. Police: can file a complaint (Turkish Penal Code article 207 — attack on system integrity), but attribution (who the attacker is) is very difficult, requires ISP IP logs (wait for weeks).
if its a ddos attack, the server is normal, network is congested. set up cdn (start with cloudflare free tier), enable rate limiting file a police complaint. attribution is hard but insurance covers mitigation costs...
Doki · SEO consulting · 2023
DDoS detection: Monitoring (bandwidth spike detection — MRTG, Grafana alerts), NetFlow analysis (traffic pattern: UDP flood = high packets/low bytes), Log analysis (sudden spike in access.log, low unique IPs). Mitigation tools: UFW rate limiting (ufw limit 80/tcp), Fail2ban (auto IP blocking after threshold), iptables (syn-flood protection: tcp-syn-cookies), Cloudflare WAF (app-level bot detection), AWS Shield (network-level mitigation). DDoS-as-a-Service detection: attack pattern (botnet signature), command-and-control infrastructure, ransom email (if extortion exists). Response procedure: 1) Detection (alert trigger), 2) Enable CDN/mitigation service, 3) Notification (customer comms: under attack, service restoration ETA), 4) Investigation (forensics: attack vector, attacker motivation), 5) Hardening (future prevention), 6) Recovery (service restoration, business continuity).
Set up CDN immediately, start Cloudflare. Enable firewall rate limiting. Once the DDoS is over, send an email to customers — notifying them that you were under attack and things are back to normal. File a claim with insurance requesting mitigation costs. Also start a police report...
edit: I wrote something wrong above, sorry about that.
Doki · E-commerce infrastructure · 2025
DDoS response playbook: 1) Detection & verification (confirm attack ensure it's not a legit traffic spike) 2) Incident escalation (notify ISP, enable DDoS service), 3) Communication (customer notification, status page updates, social media), 4) Mitigation (enable CDN rate limiting, geo-blocking), 5) Investigation (attack pattern analysis, attacker motivation) 6) Resolution (attack stopped services restored) 7) Post-incident review (lessons learned, prevention upgrades). Prevention: DDoS-resistant architecture (distributed servers, load balancing), redundancy (multiple ISPs backup infrastructure), insurance (DDoS coverage $2M+ depending on policy).
i think it's hard to be that definitive about i'm uder a ddos attack and hasty decisions become decisions you have to fix six months later.
that's all sorry if I went on too long.
Doki · Vulnerability scanning · 2025
The most overlooked point about i'm under a ddos attack is this: Having backups accessible on the same network and with the same identity makes them part of the target.
Im also curious if anyone does it differently.
I can't fully agree with this. Payment information changes are never verified through the channel they came from.
If I were you, I'd go this route.
Doki · Backup setup · 2026
i'm writing this so you don't make the same mistake. the biggest time-waster for us was not knowing who had the final say.
i can't fully agree with this. taking measures without an inventory leaves doors you haven't seen open.
the harder it is to reverse a decision, the slower you should make it and this is my opinion Im not claiming its absolute truth.
Let me write how it's done in practice. Everything goes well for the first three months; problems arise in the fourth.
Hasty decisions become decisions you have to fix six months later. This is my opinion, I'm not claiming it's absolute truth.
Great work. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.
If you have questions, write them; I'll answer as best I can.
Correct in theory, but it doesn't work that way in practice. Your time to detect an issue directly determines its cost.
That's all, sorry if I went on too long.
Doki · Infrastructure migration · 2026
The discussion got scattered let me summarize. If 2FA is on, a stolen password alone is useless.
If I were you, Id go this route.
I feel the same way. When we decide without measuring, we always end up in the same place.
Good luck with that.