DDOS Scrubbing Capacity: How to Judge Tbps Claims

DDOS Scrubbing Capacity: How to Judge Tbps Claims

Open almost any mitigation provider’s data sheet and the DDoS scrubbing capacity figure sits near the top, in bold, usually followed by a unit that ends arguments: 10 Tbps, 30 Tbps, 200 Tbps and rising. The number is there to close the conversation. It should open it, because the figure on the page and the capacity that will actually stand between your prefix and a botnet on a Tuesday afternoon are rarely the same thing.

Scrubbing capacity means the volume of attack traffic a provider can ingest, inspect and filter before passing clean traffic on to you. Simple enough. The difficulty is that vendors measure it in at least three incompatible ways, and the one they publish is almost always the most flattering.

What a scrubbing capacity figure is actually measuring

Three distinct numbers get printed under the same label.

Total network capacity is everything the provider’s backbone can carry, including transit and content delivery traffic that has nothing to do with mitigation. Aggregate mitigation capacity is the sum of filtering capability across every scrubbing location they operate. Per-centre capacity is what a single site can ingest and clean. Only the third one is about you.

At the time of writing, published figures span two orders of magnitude in framing. Some platforms quote well over 100 Tbps spread across several hundred points of presence; others quote around 30 Tbps across roughly two dozen dedicated scrubbing centres. Do the division before you do anything else. A headline that divides into a few hundred gigabits per location is telling you something very different from one that divides into several terabits, and the fewer, larger model is often the stronger one for a single-region customer. Capacity is never distributed evenly anyway, which is exactly why the next question matters: what is the ingest and mitigation capacity of the specific centre my traffic is diverted to, and what happens when that centre is the one under pressure?

Anycast changes the question

On an anycast platform, a volumetric flood is absorbed wherever the sources are, which is genuinely useful against a globally distributed botnet. It is less useful when the attack sources are concentrated in Europe and your diversion lands in one or two European sites. Aggregate capacity across hundreds of global locations is an architecture statement. It is not a promise about your prefix.

Inside the platform there are also per-customer ceilings that have nothing to do with the network: a clean-traffic commit, a cap on how many protected prefixes or hostnames you may onboard, and in appliance-backed or licensed models a throughput entitlement written into the order form. A 100 Tbps platform will happily enforce a 500 Mbps licence against you.

Where UK traffic lands, and why the nearest centre decides the outcome

For most UK buyers the relevant ingest points are London and Slough, and the relevant peering is at LINX and LONAP. Ask which facility your prefix would be diverted into, what that site’s ingest capacity is, and where it fails over. The answer to the third question is frequently Amsterdam or Frankfurt.

That failover is not neutral. London to Frankfurt is in the region of ten to fifteen milliseconds of round-trip time on a good path, and a checkout flow or a chatty API that makes twenty or thirty sequential calls will show it. Sessions that were comfortable become marginal. Timeouts tuned for in-country latency start firing. You mitigated the attack and still lost conversions, which is a conversation worth having before you sign rather than during an incident.

Data centre DDoS protection sold at the rack deserves particular scepticism. The colocation provider may advertise protection, but the filtering usually happens at an upstream transit provider’s edge or a third-party scrubbing partner, under a contract you have never read, with a threshold you have never been told. Ask who owns the mitigation, not who sold it.

Bits per second is the wrong unit for most real attacks

This is the part buyers underestimate. Forwarding hardware fails on packet rate long before it fails on bandwidth. At minimum Ethernet frame size, a 10 Gbps link carries roughly 14.9 million packets per second; 100 Gbps of 64-byte packets is close to 149 Mpps. Routers, firewalls and intrusion-prevention appliances run out of forwarding capacity and state-table headroom at those rates while the bandwidth graph still looks calm. A flood that never approaches an advertised terabit ceiling can still flatten an edge device.

Carpet bombing exploits the other half of the problem: detection thresholds. Spread a few hundred megabits per second across the 1,024 addresses of a /22 and you have tens of gigabits arriving at the network while no single IP crosses a per-host trigger set at, say, 1 Gbps. Nothing is detected. Nothing is diverted. Detection configuration, in that scenario, matters far more than the headline on the data sheet, and the same arithmetic applies to the terabit-scale attacks that make the headlines.

Layer 7 is a different unit again. Application floods are measured in requests per second and new connections per second, and TLS handshakes are deliberately asymmetric: cheap for the attacker, expensive for your termination point. Gigabits are irrelevant there. The relevant figures are proxy request capacity and policy quality, which is a separate discipline covered in our breakdown of where application layer defences actually fail.

So ask for three numbers, not one: Tbps, Mpps and concurrent sessions or requests per second, per scrubbing centre. Providers who track their own platform properly can answer. The ones who cannot are telling you something.

The contract terms that quietly resize your capacity

A mitigation can succeed technically and still cost you money or availability, because the commercial terms cap what the platform is allowed to deliver.

  • Clean-traffic commit and overage. You commit to a volume of clean traffic, often billed at 95th percentile. Mitigation works, legitimate traffic keeps flowing, and the invoice arrives with overage at a rate nobody modelled. Check whether attack traffic is excluded from the measurement, in writing.
  • Black hole thresholds. Lower tiers at hosting and cloud providers frequently protect up to a stated rate and null-route the address above it, usually by announcing it with the BLACKHOLE community defined in RFC 7999. The attacker gets exactly what they wanted, delivered by your own provider. Find the threshold in the plan documentation before you buy, and find out how long the null route stays in place.
  • Attack-size caps and fair use. “Unlimited mitigation”often carries a clause permitting renegotiation after repeated incidents, or a cap on single-attack volume buried in an appendix.
  • SLA credits. These are written against time-to-mitigate and availability, never against capacity. No provider refunds you for failing to deliver 30 Tbps.

Those terms, not the engineering, are where most unpleasant surprises live. We have gone through the pricing models in more detail in our guide to what UK DDoS protection really costs.

Whose capacity are you buying?

A large share of UK managed DDoS protection offers are resold. Hosting companies, managed service providers and smaller security firms front someone else’s scrubbing network under their own brand, which is not inherently a problem; it becomes one when nobody in the chain can change a policy during an incident.

Tracing the real network is straightforward. Look up the announcing AS for the protected prefix during and outside mitigation using RIPEstat or any public looking glass. Check the CNAME chain and the name servers. Read the vendor name in the footer of the attack report you are shown. Then ask directly: whose AS announces my prefix when I am under attack, and who has authority to change filtering policy on it?

The dividing line is simple. If a human on the provider’s side cannot adjust policy at 02:00 without hunting for your sign-off, you have bought monitoring, not management. Identical underlying capacity produces very different outcomes depending on who is tuning the signatures, writing the rate limits and making the diversion call, which is also why a clear method for separating an attack from an ordinary outage belongs in the runbook on your side too.

Capacity across all three surfaces, including the one left out

Protection is usually sold for one surface and assumed for three.

Network and transport. BGP diversion to a scrubbing centre, returned over GRE or a cross-connect. This is the layer the Tbps figure describes, and the only one it describes.

Application. Reverse proxy capacity in requests per second, plus WAF rule quality and bot classification. Raw bandwidth tells you nothing here.

Authoritative DNS. Routinely outside the protection contract. A site can sit behind a very large scrubbing platform while its zone is served by a provider with a handful of anycast nodes, making name resolution the cheapest thing in the estate to knock over. Our buyer’s guide to authoritative DNS protection covers what to ask for there.

And then there is origin exposure, which defeats capacity entirely. Proxy bypass is far more often caused by a leaked origin address than by an attack that genuinely outsizes the platform. The usual culprits: an MX record pointing at the same host, an old A record on a forgotten subdomain, historical DNS data, certificate transparency logs listing every hostname you have ever requested a certificate for, and an admin or SSH endpoint reachable on the origin IP. Audit those first. Then restrict the origin to accept traffic only from your provider’s published ranges. Unlimited scrubbing capacity in front of a directly reachable server protects nothing.

Sizing from evidence rather than data sheets

Start with your own numbers, not the vendor’s. Take peak legitimate throughput, peak packet rate and peak requests per second from the last twelve months, add realistic growth headroom, and work out what an hour of downtime costs in revenue, transaction value, contractual penalties or statutory deadlines missed. Public sector and regulated services often find the deadline matters more than the revenue. The NCSC’s denial of service guidance makes the same underlying point: understand what normal looks like for your service before you try to specify protection for it.

Then decide between always-on and on-demand. On-demand is cheaper and introduces a diversion window governed by detection time, BGP convergence and, for DNS-based redirection, your record TTL. Always-on removes that window and costs more every month. Compare the monthly difference against the cost of the diversion window, not against an abstract preference for one architecture.

Pre-contract checklist

  1. Named ingest locations serving UK prefixes, with per-centre capacity and the designated failover site.
  2. Published Mpps and concurrent-session or requests-per-second limits, not just Tbps.
  3. Per-IP and per-prefix detection thresholds, and how carpet bombing across a /22 is detected.
  4. Any black hole or null-route threshold in your tier, in writing, with the removal process.
  5. Clean-traffic commit, overage rate and whether attack traffic is excluded from billing.
  6. Time-to-mitigate definition, measured from what event, with the SLA credit mechanism.
  7. A redacted post-incident report from a real mitigation, with the vector breakdown.
  8. The escalation matrix: named contacts, out-of-hours route and who authorises diversion.
  9. The announcing AS during mitigation, confirming whose network you are buying.

Run that against every quote. A provider with genuine DDoS scrubbing capacity behind the marketing will answer all nine in a single call; the ones who keep returning to the headline terabit figure are telling you where their confidence actually sits.

Frequently Asked Questions

What does DDoS scrubbing capacity actually mean?

It is the volume of attack traffic a provider can ingest, inspect and filter before forwarding clean traffic to you. The complication is that the published figure may describe total backbone capacity, mitigation capacity summed across every location, or the capacity of one scrubbing centre. Only the last of those relates to what protects your prefix.

Is a higher Tbps figure always better protection?

No. A larger aggregate spread thinly across hundreds of locations can leave less capacity at the specific site serving your traffic than a smaller platform with a few large centres. Packet rate, detection configuration, policy tuning and contract terms all decide outcomes that bandwidth alone does not.

How much scrubbing capacity does a typical UK business need?

Size it against your own peak legitimate throughput and packet rate with growth headroom, rather than against the largest attack in the news. For most organisations the binding constraints are the per-customer commit, the detection thresholds and whether the origin is reachable directly, not the platform ceiling.

What is a black hole threshold and how does it limit mitigation?

It is a rate above which your provider stops filtering and simply discards all traffic to the targeted address, usually by announcing it with the BLACKHOLE community from RFC 7999. The attack stops reaching your network and so does everything else. Entry-level hosting and cloud plans commonly include one, so check the documented threshold and the removal procedure before buying.

How can I check whose scrubbing network my provider is really using?

Look up the announcing autonomous system for your prefix on a public looking glass or RIPEstat, follow the CNAME and name server chain, and read the vendor name on any attack report you are given. Then ask the provider directly who announces your prefix during mitigation and who is authorised to change policy out of hours.



Law Firm Cyber Attack Protection: Beyond Phishing

Law Firm Cyber Attack Protection: Beyond Phishing

Law firm cyber attack protection, as it is sold and as it is bought, nearly always means email: a filtering gateway, phishing simulations twice a year, a mandate fraud warning on the completion statement, and a cyber policy with a conveyancing fraud sub-limit. That half of the problem has had a decade of attention, and most UK firms have genuinely improved. The other half has had almost none. Nobody at renewal asks what happens when the client portal, the document exchange and the firm’s authoritative DNS all stop answering at three o’clock on a Friday afternoon.

That is the gap this piece is about: availability, how it fails, and how to buy and verify protection for it without taking a vendor’s word for anything.

What attackers actually target in a law firm, and the half nobody covers

The confidentiality attacks are familiar. Business email compromise, invoice and mandate redirection on completion funds, credential theft against Microsoft 365, ransomware that encrypts a file share and the backups sitting on the same domain. Firms have bought tooling and training against all of it, and insurers have pushed hard in the same direction.

Availability attacks sit outside that conversation entirely. They include volumetric floods against the public website; request-level attacks aimed at the login flow and search function of a client portal or document exchange; attacks on the authoritative nameservers that publish every hostname the firm uses; and extortion emails demanding payment in cryptocurrency to stop, sometimes preceded by a short demonstration burst against the marketing site.

Legal is an attractive target for both motives, and for different reasons. Work is deadline-bound, so an outage has a hard commercial edge that an attacker can time. Clients in litigation and corporate transactions are acutely sensitive to any sign that the firm is unstable. And high-value matters are often publicly visible, from planning objections to M&A announcements, which gives an aggrieved party a clear target and a clear window. One UK practice found its systems disrupted badly enough by a flood of inbound mail that it rebuilt its web security afterwards, which is a reminder that the trigger is not always sophisticated and rarely announces itself in advance.

Mapping your own exposure in an afternoon

Before anyone looks at a quote, build four columns. Every client-facing hostname the firm owns, including the ones marketing created and forgot; who hosts each one; who runs the DNS for the zone; and the name and mobile number of the person you would ring about it at two in the morning. Most firms cannot complete column four for at least one row. That blank is the finding.

The three surfaces law firm cyber attack protection has to cover

Network and transport floods

These are the attacks discussed in gigabits per second, occasionally terabits. A decent hosting provider or ISP absorbs the small end without telling you. What they will not do is carry a sustained attack aimed at your single public IP address, because at a certain point the economically rational move is to null-route you to protect everyone else on that segment. Blackholing is not mitigation. It is the provider agreeing with the attacker.

Application-layer attacks

This is where portals actually fall over. A few thousand well-chosen requests per second against a document search, a login endpoint that does a bcrypt hash on every attempt, or a matter-lookup page that runs an unindexed query, will exhaust the database long before anything registers on a bandwidth graph. Protection sized purely on gigabits of clean traffic will sail through a volumetric flood and still let the conveyancing portal die quietly. Understanding the gaps in application-layer defences matters more for a law firm than headline scrubbing capacity, because the valuable systems are all request-driven.

Authoritative DNS, the layer nobody has reviewed

Ask who controls the firm’s nameservers. In a worrying number of practices the answer is a web agency’s registrar account, sometimes a former IT supplier’s, on a single DNS provider, with no secondary nameservers and no monitoring. Lose that and nothing else in the stack matters: the portal, webmail, the marketing site and any MX-dependent mail flow all stop resolving at the same moment, and the shiny proxy in front of the website never sees a packet. Redundancy here is cheap and badly under-bought; a second authoritative DNS provider is usually the highest-value hour of work available to a firm this week.

Third-party dependencies you do not control

Practice management SaaS, e-signature platforms, hosted document portals and card payment pages all inherit someone else’s protection posture. Your Lexcel file says you have business continuity; your supplier’s contract may say they will use reasonable endeavours. Those are not the same sentence. Put the question in writing to each supplier at renewal and keep the answer.

Why the proxy gets bypassed: origin IP leakage, not attack size

When a protected site goes down, the cause is far more often that the attacker found the origin than that they out-muscled the scrubbing network. The firm’s real server address leaks through routes nobody audits: the MX record, SPF entries listing the mail server, historical DNS records archived by passive DNS services, TLS certificate transparency logs that publish every hostname you have ever certificated, a webmail or VPN endpoint sitting on the same /24 as the web server, or a staging site at new.firmname.co.uk that resolves straight to the origin and has done since 2021.

The test is one question, and it is a yes or no. Does the origin accept TCP connections on 80 and 443 from anything other than the protection provider’s published IP ranges? If yes, the protection in front of the site is decorative. Three fixes, in order: allow-list the provider’s ranges at the host firewall or security group and drop everything else; validate the host header and a shared secret header at the web server so direct hits are rejected; and rotate the origin IP address after onboarding, because the old one is already in a passive DNS database somewhere.

Attack volume is the part vendors like to talk about. Reachability is the part that decides the outcome.

Extortion and the first hour

Triage before escalation

Not every Friday outage is an attack. A bad deployment, an expired certificate, a hosting provider’s own incident and a legitimate traffic spike from a press mention all look identical from reception. Check from outside the network, not from a machine on the office LAN; compare the web server’s request logs against the load balancer’s; look at whether the source addresses are geographically scattered and hitting one expensive URL repeatedly. Having a short, written routine to tell a DDoS from an ordinary outage saves the twenty minutes that usually get burned arguing.

If a ransom demand arrives

Paying achieves nothing reliable. Payment marks the firm as responsive to pressure, and the group that sent the email may not be the group capable of stopping the traffic. Preserve instead: the email with full headers, the exact timestamps of the first and peak traffic, sample requests and source data from the logs, and the provider’s post-attack report with its vector breakdown. That evidence is what makes any later legal or law enforcement route viable rather than theoretical.

Reporting duties

Four obligations sit in different places and a firm should know which apply before the day arrives:

  • The SRA Standards and Regulations require prompt reporting of serious breaches of the regulatory arrangements, which can include an incident that materially affects the firm’s ability to act for clients;
  • UK GDPR requires notification to the Information Commissioner’s Office within 72 hours of becoming aware of a personal data breach where there is a risk to people’s rights and freedoms, and the ICO is explicit that a loss of availability counts as a breach, not just unauthorised disclosure;
  • Clients on live matters need telling, in plain terms, where a deadline or completion is affected, and that message is better coming from the partner than from an estate agent;
  • Action Fraud takes the crime report, and the National Cyber Security Centre should be notified where the incident is significant.

Denial of service is a criminal offence in the UK under section 3 of the Computer Misuse Act 1990, which covers unauthorised acts intended to impair the operation of a computer. Useful to know, and worth stating to staff who assume this is a grey area. Realistically it does not shorten your outage by a second, and attribution is slow, so treat the criminal route as evidence preservation rather than recovery.

Buying protection: deployment models, managed meaning, and the cost case

Three models, and the choice is mostly determined by what the firm owns. Reverse proxy suits the common case: one marketing site, a client portal, a document exchange, all behind DNS you can repoint, with no IP space of your own. BGP scrubbing is for firms announcing their own prefix, typically those running an on-premises data room or legacy case system, and it protects everything in the range including mail and VPN. Hosting-level filtering is the cheapest and the weakest; it tends to stop at the volumetric tier and leaves the application layer to you.

On always-on versus on-demand: on-demand diversion is cheaper and adds a detection window plus a BGP announcement and propagation window before mitigation begins. For a firm whose work turns on 16:00 filing cut-offs and completion days, those minutes are a commercial decision, not a technical footnote. Decide now who is authorised to trigger a diversion at 23:00 on a Sunday without a partner’s sign-off, and write the name in the runbook.

What “managed”has to mean in the contract

Managed is a word, not a service level. The dividing line is simple. If a human on the provider’s side is not empowered to change a rate limit or a WAF rule at 16:40 on a Friday while the conveyancing portal is being hammered, without waiting for someone at the firm to raise a ticket, you have bought monitoring, not management. Get four things in writing: the onboarding and rule tuning done before the first attack rather than during it; named escalation contacts on both sides with out-of-hours numbers; explicit authority to change policy mid-incident; and a written post-attack report with timestamps, vectors and actions taken.

The business case, built from downtime rather than fear

Do the arithmetic openly. Take the fee earners who would be unable to work for an afternoon, multiply by the hours lost and by your own charge-out rates, and you have the cost of that single incident in lost recoverable time, before you count a missed completion, an abortive lender drawdown or the partner hours spent on client calls. Compare that number to an annual managed protection quote. Do not compare quotes to each other, which is how firms end up buying the cheapest version of the wrong thing. The structure of UK pricing varies by model, so check current figures with providers directly rather than relying on anything published months ago.

Judging providers on evidence rather than sales decks

Much of what is marketed in the UK as DDoS-protected hosting resells someone else’s scrubbing network. That is not disqualifying, but you need to know it. Ask whose capacity you are buying, which points of presence serve UK traffic (London is not a complete answer if the only nodes are in Frankfurt and Amsterdam), and who physically answers the phone at three in the morning, because that determines both the real capacity and who is accountable mid-incident.

Then press on the SLA. What does it pay out, what triggers it, how is time-to-mitigate measured, and who measures it? A service credit worth one month of fees against a lost afternoon of fee earner time is a gesture, not a remedy. And ask for a redacted report from a real incident. Report quality tells you more about the operations team than any capacity figure on a slide: whether they identified vectors, when a human intervened, and what they changed.

Run this short list alongside Cyber Essentials, Lexcel and the insurer’s questionnaire. Note that Cyber Essentials and Cyber Essentials Plus, for all their value, assess firewalls, secure configuration, access control, malware protection and update management. None of those five controls test whether your site stays reachable under attack. Availability is the box nobody ticks because nobody asks, which is precisely why it is still the weak point in most firms’ answers. Effective law firm cyber attack protection closes it by naming the surfaces, locking the origin, and putting a human with authority on the other end of the phone before the first demand email arrives. Background reading on how these attacks are structured and resourced is collected across DDoSInfo, and the case of the firm that hardened its web security after an attack is a reasonable place to start with partners who need convincing.

Frequently Asked Questions

What does law firm cyber attack protection need to cover beyond email security?

Availability of every client-facing system: the public website, client login portals, document exchange, and the authoritative DNS that publishes all of them. Email controls address confidentiality and fraud; they do nothing if the portal is unreachable on a completion day. Treat network floods, application-layer request attacks and DNS as three separate surfaces with separate owners.

Can a small law firm’s website really be taken offline by a DDoS attack?

Yes, and it rarely takes a large attack. A booter service costs very little and a few thousand requests per second aimed at a login page or document search can exhaust the database behind it. Smaller firms are often more exposed because their site and portal share one modest origin server with no filtering in front of it.

What should a firm do if it receives a ransom demand threatening to take its site down?

Do not pay and do not reply. Preserve the email with full headers, confirm whether an attack is actually in progress, notify your protection provider and hosting supplier, and report to Action Fraud and, if the incident is significant, the NCSC. Payment marks the firm as responsive to pressure and offers no reliable guarantee the traffic stops.

Does a law firm have to report a denial of service attack to the SRA or the ICO?

It depends on effect, not on the label. The SRA Standards and Regulations require prompt reporting of serious breaches, which can include an incident that materially affects the firm’s ability to act for clients. Separately, the ICO treats loss of availability of personal data as a personal data breach, so a 72-hour notification may be required where there is a risk to individuals. Take advice from the COLP rather than deciding on the day.

Is always-on or on-demand mitigation better for a firm with court filing deadlines?

Always-on, in most cases. On-demand diversion is cheaper but adds detection, announcement and propagation time before mitigation starts, and those minutes land badly against a filing cut-off or a lender’s close of business. If budget forces on-demand, agree the out-of-hours authorisation route in advance and name the person who can trigger it without a partner’s approval.

How much should a UK firm expect to spend on managed DDoS protection?

Pricing varies by model: reverse proxy plans are usually billed per protected hostname or per volume of clean traffic, while BGP scrubbing is priced against committed capacity and the size of the prefix. Get current quotes directly, since published figures date quickly. The useful comparison is not quote against quote but quote against your own downtime cost, calculated from fee earner hours lost in a single three-hour outage.



DDOS Protection Cost UK: What You Really Pay

DDOS Protection Cost UK: What You Really Pay

Ask five UK providers to price protection for the same ecommerce site and the quotes will range from a small monthly subscription to an annual contract many times larger, all of them described as DDoS protection. That spread is not a negotiating tactic. The DDoS protection cost UK buyers face varies by two orders of magnitude because the word “protection”is being used to sell at least three different products, bought by three different sorts of customer, with wildly different amounts of human engineering attached. Work out which product you are actually being quoted and the numbers stop looking random.

What follows is a cost anatomy from the buyer’s side: what each pricing model charges for, which line items stay invisible until the first attack, and how to turn downtime into a figure your finance director will sign.

Why DDoS protection quotes in the UK swing so wildly

Three markets hiding behind one search term

The first market is bundled protection: filtering included with a hosting plan, a content delivery network (CDN) tier or a cloud load balancer. Marginal cost near zero, tuning near zero.

The second is mid-market managed service: a monthly fee, a named provider, some human involvement, usually a reverse proxy or a small scrubbing arrangement in front of a handful of properties. This is where most UK mid-market buyers end up, and where the contract language matters most.

The third is enterprise Border Gateway Protocol (BGP) scrubbing with committed capacity: you announce your own /24, traffic is diverted to scrubbing centres, clean traffic comes back over GRE tunnels or a cross-connect. You are buying network capacity, a routing relationship and an engineering team. It has a high floor because all three cost money whether or not you are attacked.

What an entry-level plan genuinely covers

Entry-level proxy plans advertised in the UK market at low monthly prices are real products, not bait. They buy a share of a large anycast proxy estate, automated volumetric filtering, a rate-limiting engine and a dashboard. For a brochure site or a small SaaS front end, that is often proportionate.

What they do not buy is anyone’s attention. Best-effort means exactly that: your traffic is defended by the same automated policy as everyone else on the shared tier, and if a layer 7 attack slips through the generic rules, the rule changes are yours to write. If nobody on the provider’s side is authorised to change policy at 03:00 without your written sign-off, you have bought monitoring, not management.

Why G-Cloud day rates are quoting people, not bandwidth

Public sector buyers looking at the Crown Commercial Service’s Digital Marketplace will see mitigation services listed at a price per unit per day. Those unit prices confuse people who assume they are paying for gigabits. They are not. G-Cloud style day rates typically price consultancy, onboarding, incident response time and diversion support, in other words a human being for a day. Comparing a day rate against a monthly subscription is comparing a plumber’s call-out charge with a water bill.

The question that explains most of the gap

Several UK “providers”do not own a scrubbing centre. They resell capacity on a larger network, wrap it in a portal and a support contract, and add margin. Sometimes there are two resale layers. Each one is another party that must be woken up before a mitigation policy changes, and another margin on your invoice.

So before you compare headline prices, ask who owns the scrubbing centres, whose autonomous system number (ASN) the traffic is cleaned on, and what your escalation path looks like in the middle of the night. Two quotes that differ by 10x for the “same”protection are usually not describing the same distance between you and the engineer who tunes the filter.

The pricing models behind the number on your quote

Per protected property or per protected IP. A flat monthly fee covering a defined number of domains, hostnames or IP addresses. The trap is counting creep. Staging, a customer portal, an API endpoint, a mail relay and a second data centre each add a chargeable unit, and the tidy monthly figure can multiply by the time the estate is honestly documented. Count every public-facing address before signing, not after.

Clean traffic bands with overage. The contract commits you to, say, 100 Mbps of clean traffic delivered, with an overage rate per Mbps or per GB beyond it. This is the single most common source of a surprise invoice after an attack, because attacks change traffic shape. Legitimate users refresh, bots retry, and some providers meter the traffic they forward after scrubbing rather than the flood they dropped. Read the metering definition, ask whether it is 95th percentile or peak, and ask what happens to billing during a declared incident.

Committed capacity and per-Gbps pricing. BGP scrubbing deals price a committed clean bandwidth tier plus the plumbing: GRE tunnel provisioning, or a cross-connect in a shared facility with its own monthly port fee. Budget for the network engineering time too. Announcing a /24 to a scrubbing provider, testing failover and documenting the withdrawal procedure is not a half-day job.

On-demand and emergency onboarding. On-demand looks cheaper on the monthly line because you pay for standby, not for constant traffic handling. The costs move elsewhere: diversion time while routes propagate, and in many contracts an emergency onboarding fee if you are attacked before you are provisioned. Compare the annual always-on premium against that fee plus the extra minutes of downtime, not against zero. Our breakdown of always-on versus on-demand DDoS protection works through where each model genuinely fits.

What each deployment model really costs once you add everything up

Reverse proxy or CDN-fronted protection

Lowest entry cost, priced on requests and bandwidth, quick to deploy with a DNS change. Its weakness is not capacity. It is origin leakage. If your server’s real IP address is still visible in historic DNS records, mail headers, TLS certificate transparency logs or an old subdomain, attackers route around the proxy entirely and hit the origin directly.

No pricing tier fixes an exposed origin. Budget for the remediation instead: new origin addressing, firewall allow-lists restricted to the provider’s published ranges, cleaning up stale A records and moving outbound mail off the web server. That work is usually a few days of engineering, and it is the difference between a paid proxy service that protects you and one that decorates your invoice.

BGP scrubbing and always-on routing

Higher floor, because you are buying capacity and a route rather than a shared proxy slot. It suits ASN holders, hosting companies, data centre operators and anyone protecting non-HTTP services such as game servers, VPN concentrators or VoIP. Costs to model: committed Gbps, tunnel or cross-connect fees, a /24 you actually control, and the internal staff time to run the diversion.

Hosting-level filtering

Bundled with a DDoS protected hosting package, near-zero marginal cost, and genuinely useful against crude volumetric floods. What you rarely get is tuning, a named escalation contact or a forensic report afterwards. If the provider’s answer during an incident is to null-route your IP to protect their other tenants, your site is down either way.

Whichever model you choose, the sticker price is not the total. Add web application firewall (WAF) licensing if it is not included, TLS termination and certificate management, log egress charges if you ship traffic logs into a SIEM, and internal staff hours. On a mid-market deployment those adders routinely equal the mitigation fee itself.

The line items buyers forget until the first invoice

Authoritative DNS. Left off the quote more often than any other component, then added later and billed separately by query volume. A site sitting behind a fully mitigated proxy is still unreachable if its name servers fold, and name servers are a soft target precisely because they are UDP-based and often hosted with a registrar nobody has thought about since 2019. Price network and transport layer, application layer and DNS as one budget line. Our buyer’s guide to authoritative DNS protection covers what to demand from that part of the stack, and the NCSC’s guidance on denial of service attacks is worth putting in front of anyone who thinks the web tier is the whole problem.

Attack reports and forensic exports. Sometimes a paid add-on, sometimes only available on enterprise tiers. Yet a vector breakdown with timestamps, source distribution and packet rates is the evidence you need for an insurer, a regulator, your own customers under an uptime clause, or any legal action following a DDoS attack. If the report costs extra, that is a line item, not a nicety.

What “managed”buys. The most expensive undefined word in a DDoS contract. Pin it down in writing: will the provider change rules mid-attack on their own authority, or does every tuning decision wait on a ticket and your approval? The approval model is cheaper monthly and far more expensive per incident, because the clock runs while your on-call engineer finds the portal password. Ask how many rule changes are included per year and what a change request costs beyond that.

SLA credits. Time-to-mitigate commitments are meaningful only if the measurement method is stated. There is a large practical difference between “60 seconds from detection”and “60 seconds from customer report”, and credits are almost always capped at a percentage of the monthly fee. A 100% credit on a £900 month does not cover a £20,000 trading outage. Treat credits as a signal of confidence, not as compensation.

Price your downtime before you price the protection

The business case is arithmetic, not fear. Build it from three components: revenue or transaction value per hour, incident staff cost, and contractual exposure to your own customers.

Take an illustrative mid-size UK retailer selling online. Spread across realistic trading hours, its annual online turnover gives an average revenue per hour, but peak Saturday afternoons in the run-up to Christmas might run several times that. A four-hour partial outage on a peak weekend, assuming half of attempted orders are lost rather than deferred, removes a meaningful slice of a trading weekend’s gross revenue. Add the people pulled onto an incident bridge for a day, plus an out-of-hours agency callout, and the total climbs again before anyone mentions refunds or reputational damage.

Against that, the annual cost of a managed DDoS protection UK contract is a fixed, known number. The break-even question becomes concrete: does your organisation expect more than roughly one significant outage a year? For an ecommerce operator during peak trading, a law firm running a client document portal under a professional obligation, a healthcare supplier with booking systems, or a B2B platform with liquidated damages in its uptime clauses, the answer is usually yes.

Resist the temptation to inflate. The Department for Science, Innovation and Technology publishes an average cost of the most disruptive breach in its annual Cyber Security Breaches Survey, and boards increasingly recognise that figure. It covers all breach types, skews low because it includes micro-businesses, and will be picked apart if you present it as a DDoS number. Quote the current edition by name and date if you use it, then rely on your own revenue-per-hour model for the actual case.

How to compare UK quotes on evidence rather than sales decks

Send every shortlisted provider the same ten questions and compare the answers side by side:

  1. Who owns the scrubbing centres, and are you a reseller of another network’s capacity?
  2. What is the total mitigation capacity, and what capacity is committed to me contractually?
  3. Is mitigation always-on or on-demand, and what is the measured time to divert?
  4. Can your engineers change mitigation policy mid-attack without my written approval?
  5. How is time-to-mitigate measured, from detection or from my report?
  6. What clean traffic is included, how is it metered, and what is the overage rate?
  7. How many protected IPs or hostnames are included, and what does each additional one cost?
  8. Is authoritative DNS protection included, and is it billed by query volume?
  9. Is a post-incident attack report with vector breakdown included at no extra charge?
  10. What is the named escalation path at 03:00 on a bank holiday, and what phone number do I call?

Then ask for something sales teams rarely offer: a redacted attack report from a real incident in the last twelve months. A capability slide proves nothing. A report showing attack start time, vectors, peak packet rate and the minute mitigation engaged tells you whether the operations team exists. If you want a structured starting point for evaluating vendors, our DDoS protection service comparison sets out how the main approaches differ in practice.

Terms worth negotiating: minimum term (push back on 24 months if you have not tested the service), a burst allowance that waives overage during a declared attack, waiver of emergency onboarding fees, and an exit clause that includes DNS TTL handover so you can leave without a self-inflicted outage.

Red flags, in order of seriousness: “unlimited”capacity claims, which no network can honour once you read the fair use clause; “fully managed”with no definition of who is authorised to act; mitigation SLAs with no stated measurement method; and any provider who will not name the network their traffic is cleaned on. One more, quieter one: a quote that covers only HTTP when half your revenue runs through an API or a DNS zone nobody has audited.

The honest summary of DDoS protection cost UK-wide is that you are pricing three things at once: capacity, authority to act, and evidence afterwards. Cheap plans give you the first. Only the contract tells you whether you are getting the other two, and only the second attack tells you whether you were right. Read the clauses before you compare the prices.

Frequently Asked Questions

How much does DDoS protection cost in the UK per year?

Entry-level proxy plans advertised in the UK market start at modest monthly subscriptions. Mid-market managed services typically land in the low thousands to low tens of thousands annually, depending on protected IP counts and committed clean traffic. Enterprise BGP scrubbing with committed capacity runs higher again, and public sector day rates on G-Cloud listings are quoted per unit per day for incident and consultancy work. Check current pricing directly, as published rates change.

Why is there such a big gap between cheap and enterprise DDoS protection pricing?

Partly technology, mostly people and margin. Cheap plans share automated filtering across thousands of customers with no dedicated engineering time; enterprise contracts commit capacity, a routing relationship and named responders. The resale chain matters too, because each layer between you and the network that owns the scrubbing centres adds margin and removes direct access to the engineers tuning the mitigation.

Does free or bundled protection from a host or CDN count as enough?

For a low-risk brochure site, frequently yes. For anything revenue-bearing, the limits show up fast: little or no tuning, no forensic report, and a provider whose incentive during a large attack may be to null-route your address to protect other tenants. Bundled filtering also rarely covers your authoritative DNS, which is a separate failure point.

What extra charges can appear on an invoice after an attack?

Overage on clean traffic bands is the most common, followed by emergency onboarding fees if you were on an on-demand plan and not yet provisioned. Then look for per-incident support charges beyond included hours, rule change fees above an annual allowance, paid forensic report exports and DNS queries billed by volume.

How do I justify the cost of DDoS protection to finance?

Model revenue or transaction value per hour at peak, add incident staff cost and any liquidated damages you owe customers under uptime clauses, then compare one realistic outage against the annual contract value. Present it as expected loss avoided, not as a doomsday scenario, and cite any national figures you use by source and year so the number survives scrutiny in the room.

Why DDOS Attacks on Government Websites Succeed

Why DDOS Attacks on Government Websites Succeed

A Telegram channel posts a screenshot of a council homepage timing out, the local paper picks it up before lunch, and by mid-afternoon a service owner who has paid for protection for three years is explaining to a director why the site fell over at a traffic volume the provider’s own graph calls unremarkable. That is what most DDoS attacks on government websites look like from the inside. Not a terabit flood. A modest, short, well-aimed burst that found the one hostname nobody had checked.

The public explanations available to a UK public sector team are either definitional (“what is a DDoS attack”) or legal (“it is an offence”) or advisory (“raise your posture”). Useful, none of them answer the question a service owner actually has after an outage: we bought protection, so why did the site go down anyway? The answers are boringly consistent. Leaked origin addresses, unmanaged authoritative DNS, expensive dynamic endpoints, microsite sprawl, and a contract where nobody is contractually obliged to touch a mitigation policy at 02:00.

What an attack on a public sector site actually looks like

Since 2022, the dominant pattern against UK and European public bodies has been pro-Russia hacktivist activity claimed on Telegram: a target list posted in advance or shortly after, availability-only disruption, no attempt at intrusion, and a screenshot of a failed page load as the deliverable. The NCSC published guidance on 25 March 2024 following denial of service attacks against UK political party websites, and has continued to issue advisories about hacktivist groups targeting UK organisations. Treat the pattern as recurring background weather rather than a lightning bolt from the blue.

The screenshot is the payload

This changes the defence economics more than most vendors admit. If the objective is a claim of responsibility rather than sustained damage, the attacker needs five to twenty minutes of visible failure, not five hours. Attacks that fail get quietly dropped from the channel, which is why unsuccessful attempts on high-profile targets tend to vanish from the record; our write-up of hacktivists failing to take the Vatican’s site offline is the shape of an attack that never becomes a story.

Why modest volumes still make national news

A twenty minute outage on a corporate brochure site is a support ticket. The same outage on a council homepage, during a period of political sensitivity, becomes a story about resilience of public services. Journalists do not have your traffic graph. They have a screenshot and a “service unavailable”page.

Confirm it is an attack before anyone briefs communications

Hosting platform failures and DNS provider incidents produce almost identical symptoms to a layer 7 flood, and the first version of the story tends to stick. Establish the difference before you say anything: our walkthrough on telling a DDoS from an outage in ten minutes covers the mechanics. Over-claiming has a cost of its own, because an availability attack that a press office describes as a “cyber attack on resident data”creates a breach narrative you then have to unwind.

What these attacks do not do

A volumetric or application-layer flood does not read your database, exfiltrate records or authenticate to anything. It denies service. Conflating the two in a holding statement invites subject access requests, member questions and an ICO conversation you did not need to have.

Why council and department sites fall over at modest attack volume

Origin IP leakage, the usual culprit

When a proxied site goes down under a few gigabits, the attacker has almost always found the origin. Public sector estates leak origin addresses more than most, because nothing ever gets deleted from a zone file. An MX record pointing at the same server that hosts the site. A staging. Or www2. Host left behind by a supplier in 2019. A consultation subdomain from a 2016 local plan with a live A record on the same /29. Historical DNS datasets and certificate transparency logs make finding these trivial, and no reverse proxy protects an address the attacker can hit directly.

The fix is an audit rather than a product: enumerate every record in every zone you own, resolve each one, and confirm nothing outside the protected set resolves to the origin range. Then firewall the origin to the proxy’s published prefixes and your own management ranges. Most teams find at least one surprise.

Authoritative DNS, the layer outside the contract

Ask a public sector team whether their DNS is protected and a reasonable number will mention Protective DNS. PDNS is a good control and it is not the answer to this question: it protects outbound resolution from staff devices and networks, not the availability of the authoritative name servers citizens query to find you. If those name servers are two boxes in one data centre, or a single provider with a thin anycast footprint, an attack on the DNS layer takes the site off the internet without touching the web tier. The buyer’s questions are in our guide to authoritative DNS DDoS protection.

Endpoints that cost you far more than they cost the attacker

Static pages are cheap to serve and cheap to cache. Site search, planning application lookups, licensing registers, bin collection by postcode, form submissions and large PDFs are not. A few hundred requests per second against a planning search can take down an estate that shrugs off tens of thousands of requests for the homepage. Attack tooling finds these by crawling, and the asymmetry is the point: one request, one uncached database query, one PDF generated on the fly.

Microsite sprawl

This is the structural weakness of the sector. Campaign domains bought for a two-year programme, partnership sites shared with three other authorities, legacy portals from a predecessor body, all with different suppliers, different DNS and inconsistent protection. One unprotected hostname resolving to shared origin infrastructure undoes the protection on everything hosted alongside it. Inventory of hostnames is a security control, not administration.

Check the three surfaces in order: DNS, network, application

DNS

You want an anycast footprint with real geographic spread, a second independent provider (dual-primary, or secondary via zone transfer), and TTL discipline that reflects a trade-off people rarely state out loud: short TTLs give you agility to move records during an incident, while longer TTLs mean resolvers keep serving cached answers if your name servers become unreachable. If you run DNSSEC across two providers, you need a multi-signer arrangement (RFC 8901) or careful key sharing, which is precisely the detail that gets discovered during the incident rather than before it. Our rundown of staying reachable through a DNS provider outage covers the failure modes.

Network and transport

Three honest options. A reverse proxy or CDN suits HTTP services and is the default for most citizen-facing sites, but only works if the origin is genuinely hidden. BGP scrubbing protects whole address ranges including non-HTTP services, and requires that you hold your own IP space and can announce at least a /24, which rules it out for the many authorities sitting on supplier addresses. Hosting-level filtering is the cheapest and most often oversold: ask directly whether “mitigation”at your host means scrubbing or null-routing your IP, because a remotely triggered black hole completes the attacker’s objective on your behalf.

Application layer, and the accessibility decision nobody schedules

Rate shaping per client, per path and per token is where you defend expensive endpoints. Challenge policy is harder, and it is an accessibility decision as much as a security one. A blanket CAPTCHA on a housing benefit or planning objection form excludes the people least able to route around it, and UK public sector sites sit under the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018, with government guidance now pointing at WCAG 2.2 AA (check the current position before you write a policy). Plan graduated responses: cache aggressively, shape by path, use lightweight non-interactive checks, and keep one tested low-friction route (a phone line, an alternative host, a plain form) that you can publish when you do turn challenges up.

A ten minute check a duty engineer can actually run

  1. Query each authoritative name server directly and non-recursively (dig +norecurse @ns1.example SOA yourdomain.gov.uk). No answer from any of them and the problem is DNS, not the web tier.
  2. Resolve the public hostname from two networks, one of them off your corporate connection.
  3. Curl -sS -o /dev/null -w “%{http_code} %{time_total}\n”against the public hostname, then the same request pinned to the origin with –resolve and the correct Host header. Origin healthy plus public hostname failing points at the edge; both failing points at origin or capacity.
  4. Compare requests per second, bandwidth and 5xx rate on the protection portal’s traffic graph against the same hour last week.
  5. Check the hosting and DNS provider status pages before you declare anything.

What “managed”has to mean in a public sector DDoS contract

The dividing line is simple. If nobody on the supplier side is empowered to change a mitigation policy at 03:00 without waiting for your sign-off, you have bought monitoring, not management. Write it down in the contract: onboarding and rule tuning, always-on baselining, named escalation contacts on both sides, the out-of-hours trigger, and the authority to act.

Trace the resale chain

Plenty of “managed DDoS protection”bought through a hosting partner is resold capacity from a platform two steps removed, and the escalation path runs through two service desks before it reaches an engineer with policy access. Ask whose network, whose scrubbing centres, which regions, and who answers the phone. Get the answer in writing, with names or at least role-based rotas.

Judge providers on evidence, not capacity slides

Aggregate terabits of global capacity tells you little about what is available in the London or Amsterdam scrubbing centre on the day. Press instead on: time-to-mitigate wording in the SLA and what the remedy actually is; whether the SLA covers detection, mitigation or both; the quality of post-attack reports, including vector breakdown, packets and requests per second, sources and mitigation timeline, because that document is what your auditors and any police report will rely on. Ask for a redacted real report before you sign.

Buying routes and the business case

Crown Commercial Service frameworks are the usual route (check which iteration is live when you buy), and multi-supplier estates need one owner of the protection standard across all hostnames rather than each supplier doing its own thing. Build the case from the cost of a day offline: staff time diverted to phones and reception, missed statutory deadlines, delayed payments, member and press handling. Headline capacity numbers make a weak business case; a statutory consultation closing at midnight makes a strong one.

Always-on or on-demand when your service has statutory deadlines

Detection-and-divert means an attack has to be spotted, a route or DNS change made, and traffic drawn into the scrubbing centre before mitigation begins. Against a fifteen minute hacktivist burst, that sequence can complete just as the attack stops. You mitigated nothing and the screenshot already exists. For the citizen-facing hostname, always-on cover is the pragmatic choice even on a tight budget; the wider trade-offs are set out in our comparison of always-on and on-demand protection.

Calendar risk usually settles the argument. The 31 January self-assessment deadline, pre-election periods, GCSE and A-level results days, grant application windows and consultation closing dates are all dates where a thirty minute outage carries legal and reputational weight rather than just annoyance. A hybrid is common and defensible: always-on for the portal and transactional hostnames, on-demand for wider address space and internal ranges where a few minutes of diversion time is tolerable.

Then verify the promise. Run an onboarding test with the provider, agree reporting cadence in peacetime, and ask for evidence of past mitigations at comparable size. A provider who cannot show you a real timeline from a real event is selling you a diagram.

The first hour

Run a fixed sequence rather than improvising: confirm scope (one hostname or the whole estate), check DNS resolution, check reachability to origin and edge, check application behaviour and error mix, then declare and escalate to the named contact. Publish your status update somewhere that does not depend on the failing infrastructure, because a holding page served from the same name servers or the same origin is no use at all. Social channels, a separately hosted status domain and the phone lines all need to be pre-agreed, not improvised while the homepage times out.

Capture evidence as you go: timestamps in UTC, packet or request samples, firewall and proxy logs, mitigation logs and the provider’s attack report. Denial of service is an offence under section 3 of the Computer Misuse Act 1990, with a statutory maximum of up to 10 years, and the National Crime Agency’s position is that using booter or stresser services is itself an offence. Report through Action Fraud, and via your NCSC reporting route as a public sector body; our UK playbook on legal action after an attack sets out what evidence keeps options open. For dated context on how the incident mix shifted, analysis of incidents reported to the ICO and the FCA put denial of service at around a quarter of reported hacking incidents in the first half of 2022, against 4% the year before; the figure is old now, but the direction of travel it showed has not reversed.

Finish with a review that changes something. Re-audit origin exposure, name the owner of every zone and every hostname, close the contract gaps you found at 02:00, and write the triage sequence into the runbook with the escalation numbers on the front page. DDoS attacks on government websites succeed because these small things stay undone between incidents, not because the attackers are formidable. Fix the leaked records, put a second name server provider in place, protect the expensive endpoints, and make sure someone is genuinely on the hook to act before the next target list appears.

Frequently Asked Questions

Why are government websites such frequent DDoS targets?

Because they are symbolic, easy to name and produce disproportionate publicity for a small amount of traffic. Hacktivist groups aligned with geopolitical causes pick targets that make a recognisable screenshot, and a council or department homepage does that better than an anonymous corporate site. The NCSC’s March 2024 guidance, issued after denial of service attacks on UK political party websites, reflects that pattern.

Are DDoS attacks on government websites a data breach?

A denial of service attack disrupts availability; it does not in itself give the attacker access to data. It can still be a reportable security incident, and availability is part of data protection obligations, so take advice on your specific circumstances. Describing an availability attack as a data breach in public creates problems you then have to correct.

Is a DDoS attack illegal in the UK, and who should it be reported to?

Yes. Section 3 of the Computer Misuse Act 1990 covers unauthorised acts that impair the operation of a computer, carrying a statutory maximum of up to 10 years, and the National Crime Agency treats the use of booter and stresser services as an offence in itself. Report to Action Fraud, and public sector bodies should also use their NCSC incident reporting route.

How much does protection for a public sector website cost?

There is no meaningful single figure, and anyone quoting one without asking questions is guessing. Price is driven by the number of protected hostnames, whether authoritative DNS is included, clean traffic volumes, overage rates per Gbps or per million requests, and above all whether managed escalation is real or nominal. Ask for the overage terms and the out-of-hours escalation commitment in writing, because those are where the surprises live.

Does a CDN or reverse proxy alone stop attacks on a council website?

Only if the origin is genuinely hidden and every hostname you own sits behind it. Legacy mail records, staging subdomains and old A records routinely expose the origin address, at which point the proxy is bypassed entirely. Pair the proxy with an origin firewall limited to the provider’s prefixes, and audit your zones for records that resolve straight to the server.

Should a government service use always-on or on-demand mitigation?

For citizen-facing and transactional hostnames, always-on is the safer choice, because hacktivist bursts of five to twenty minutes can finish before a detect-and-divert model has finished rerouting traffic. On-demand remains reasonable for wider address space and internal ranges. If you have statutory deadlines or election periods in your calendar, weight the decision towards always-on for the services that carry them.



Application Layer DDOS Protection: 7 Real Gaps

Application Layer DDOS Protection: 7 Real Gaps

A business that has signed a scrubbing contract, bought a web application firewall (WAF) licence and put a managed service retainer on the renewal calendar tends to file DDoS under “handled”, somewhere between the firewall renewal and the cyber insurance schedule. Then the search page stops answering on a Tuesday afternoon, the origin database sits at 100 per cent CPU, and the edge bandwidth graph never moves. That is the moment most buyers discover that application layer DDoS protection and network-layer capacity are two different purchases, and they only bought one of them properly.

What follows assumes you already have something in place: a reverse proxy, a WAF, a hosting-level filter, maybe all three. The question is not what a Layer 7 attack is. The question is why the thing you are paying for did not stop it.

Why Layer 7 attacks slip past protection you already pay for

An application-layer, or Layer 7, attack sends requests that look legitimate. Valid HTTP, correct headers, often real browsers or real mobile clients driven by malware. The traffic targets whatever endpoint costs the most to serve: a full-text search, a faceted product filter, a login that triggers a password hash, a PDF or invoice render, a GraphQL query that fans out across three services. Volume is beside the point. A few thousand requests per second against a search endpoint can exhaust a connection pool that would shrug off a hundred times that in cached image requests.

So a 40Gbps clean bandwidth commitment tells you nothing about whether 8,000 requests per second to /search gets stopped. Those are different units measuring different failure modes. Network-layer defences count bits; Layer 7 defences have to count requests, weight them by cost, and decide which sessions are real.

Assess three surfaces separately, not as one product

Every estate has three surfaces that fail independently, and contracts routinely cover one or two of them:

  • Network and transport: volumetric floods, reflection and amplification, SYN floods. This is where scrubbing capacity and BGP diversion matter.
  • Application layer: HTTP and HTTPS request floods, slow-read and slow-post attacks, API abuse. This is proxy, challenge and rate-limiting territory.
  • Authoritative DNS: if the name does not resolve, everything above it is decoration.

Write those three headings on a page and map each line of your current contract to one of them. The gaps usually appear within ten minutes.

Read your own telemetry first

The diagnostic signature is unglamorous and reliable. Edge bandwidth flat at normal levels, request counts up sharply on one or two URL paths, origin CPU and database connections climbing, error rates rising on those paths before anywhere else. That pattern points at an application flood, not a pipe-filling attack. If you are still deciding whether you are under attack at all rather than suffering a self-inflicted outage, the triage steps in this guide to telling a DDoS from an ordinary outage will save you arguing about it for an hour.

Gap 1: your origin IP is still reachable, so the proxy is optional

More reverse proxies are bypassed through origin IP leakage than through sheer attack volume. Not close, in practice. An attacker who knows the origin address simply skips the edge entirely and hits the web server directly, and every rule you tuned at the proxy becomes advisory.

The address leaks from predictable places: historical DNS A records captured by passive DNS services long before you onboarded; mail headers from transactional email sent by the same host; TLS certificate transparency logs, which have been mandatory for publicly trusted certificates in Chrome since 2018 and are publicly searchable, so issuing a cert for staging.yourcompany.co.uk or admin.yourcompany.co.uk publishes that hostname to anyone watching; verbose error pages that print internal hostnames; and API endpoints that were pointed direct-to-origin for latency reasons and never moved back.

The fix is dull and effective. Firewall the origin so it accepts inbound traffic only from your provider’s published IP ranges, rotate the origin address after onboarding so historical records are worthless, and then verify it: curl the origin IP directly with the Host header set, from a network outside your own, and confirm you get a refusal rather than a page. Do that before you buy anything else. There is no point evaluating challenge algorithms while the front door has no lock on it.

Gap 2: the WAF is blocking signatures, not behaviour

A WAF ruleset is built to recognise malicious payloads: SQL injection strings, path traversal, known exploit patterns. A Layer 7 flood contains none of those. Each individual request is unremarkable and would be served happily on a quiet Wednesday. Volume in aggregate is the attack, and signature matching has nothing to match.

What actually works sits one layer up in logic: per-session request budgets rather than per-IP counters; JavaScript and cryptographic proof-of-work challenges that cost the client something; and cost-weighted rate limits, which is the control most estates are missing. A request for a cached product image and a request that triggers a full-text search or a PDF render are not equivalent, and a flat limit treats them as if they were. Set it low enough to protect search and you throttle genuine shoppers browsing a catalogue. Set it high enough for browsing and the expensive path stays wide open.

Per-IP limiting also collapses against distribution. A botnet spread across tens of thousands of residential addresses, each sending a handful of requests a minute, never trips a per-IP threshold anywhere. Every source looks like a normal user on a normal broadband line, because it largely is one. The defender’s view of botnet-driven floods is worth reading if you want to understand why source-based blocking degrades as the botnet grows.

One more thing procurement should force into the timeline: the false-positive conversation. Tuning thresholds for your real traffic shape, including scrapers you want to keep and the price-comparison feed you depend on, belongs in onboarding week. Not at 04:00 during an incident, with the commercial director asking why paying customers are seeing a challenge page.

Gap 3: your API and mobile traffic bypass the human-facing defences

Browser challenges, fingerprinting and cookie-based session tracking assume a browser. Your mobile app does not have one. Neither does your partner’s integration, your payment webhook receiver, or the B2B client pulling stock levels every thirty seconds. Turn on aggressive challenges and you break them; exempt them and you have created an unprotected lane straight to the most expensive endpoints you own.

Authenticated APIs are the attractive target precisely because they skip caching and touch the database on every call. Checkout APIs, GraphQL endpoints that allow deeply nested queries, and account-history calls all cost real compute per request. Sensible controls here are different in kind: rate limits keyed to API tokens or account identity rather than IP; explicit request cost budgets where a heavy query consumes more of the allowance than a light one; schema validation and query depth limits on GraphQL; and mutual TLS or signed requests for partner traffic so you can distinguish it cleanly.

Check subdomain coverage while you are there. One forgotten host, a legacy api-v1 or a marketing microsite on the same origin, undoes the proxy configuration for everything behind it.

Gap 4: authoritative DNS sits outside the contract

Layer 7 protection and DNS protection are frequently sold as one story and scoped as two line items. Read the schedule. Authoritative DNS is the layer most often left unmanaged, usually because it came free with the registrar years ago and nobody revisited it.

Ask who answers queries for your zone when your primary DNS provider is itself the target, how many anycast points of presence serve UK resolvers, and whether secondary DNS with a second independent provider is included or chargeable. Then look at your TTL values. A 3,600 second TTL means up to an hour before a failover to a backup provider takes effect across resolvers; 60 to 300 seconds, set in advance and left there, gives you near-immediate redirection when you need it. Lowering TTLs during an incident does not help, because the old values are already cached.

Our buyer’s guide to authoritative DNS protection goes through anycast footprints and secondary configurations in more detail, and the record of what happens when a DNS provider itself goes down explains why single-provider dependency keeps producing the same headline.

Gap 5: nobody is contractually obliged to act during the attack

The dividing line is simple. A self-service plan gives you a dashboard, a rate-limiting engine and rules you write and troubleshoot yourself. A managed service means a named engineer on the provider’s side is empowered to change policy at 03:00 without waiting for your sign-off. If that authority is not written down, you have bought monitoring, not management.

Deployment model matters more at Layer 7 than most buyers expect. On-demand mitigation, where traffic is diverted via BGP once an attack is detected, is a defensible trade-off for volumetric floods; detection plus diversion plus route convergence is tolerable when the alternative is paying for always-on capacity you rarely use. It is a poor fit for application attacks. A 5,000 requests-per-second flood against a search endpoint can drain your database connection pool well before diversion completes and traffic starts flowing through the scrubbing path. By the time mitigation is live, you have already taken the outage. The comparison of always-on and on-demand models sets out where each one genuinely earns its cost.

In procurement, run the escalation test rather than reading the SLA summary. Ask who answers the phone at 03:00 on a Sunday, whether that person is in the UK or following the sun, what they are authorised to change unilaterally, and how a customer raises severity. Then look at the wording: time to mitigate versus time to first human response (they are not the same metric), what counts as an attack start for the purposes of the clock, and the exclusions. Many time-to-mitigate commitments apply only to network-layer events and quietly exclude application-layer mitigation altogether.

Gap 6: you are buying a resale chain, not a network

A large number of UK providers resell another vendor’s proxy or scrubbing platform under their own brand. That is not automatically a problem; the underlying platforms are often excellent, and the reseller may add genuine tuning value. The problem is the extra escalation hop. During an incident, the distance between you and the engineer who can actually push a rule change is measured in handoffs, and each one costs minutes you do not have.

Questions that tend to get honest answers: which points of presence serve UK traffic and where do they sit; what is the underlying platform; who holds the capacity contract; can your engineers speak directly to the platform’s operations team during a severity-one event, or does everything route through account management. If the answers are vague, the escalation path is probably vaguer.

Gap 7: no post-attack evidence, so nothing improves

Judge a provider on the quality of a redacted post-incident report, not on a headline Tbps figure. Anyone can print a capacity number. A report that names the endpoint under attack, the rule that fired, the time from detection to mitigation and the residual request rate still reaching your origin tells you whether there was an engineer watching.

A usable attack report contains request rates broken down by endpoint and method, source distribution by network and geography, the vector breakdown, which mitigation action was applied and when, and what got through. That evidence has value well beyond engineering. Cyber insurers ask for it, boards ask for it, and any legal route following an attack depends on contemporaneous logs rather than recollection. The UK’s National Cyber Security Centre sets out the same expectation in its denial of service guidance collection: know what normal looks like, and capture what happened.

On the business case, argue from downtime cost per hour, not the headline monthly fee. UK managed pricing is typically assembled from four components: clean bandwidth commitment, the number of protected assets or domains, request volume tiers, and the level of incident support. Those variables move independently, so two quotes with similar monthly figures can differ enormously in what they cover at Layer 7. Work out revenue and recovery cost for a four-hour outage during your busiest trading window, and the comparison becomes straightforward.

The pre-purchase checklist

  1. Curl your origin IP directly from an external network with the Host header set. Do you get a page?
  2. Ask for the endpoint-level rate-limiting configuration, weighted by request cost, that the provider proposes for your top five most expensive paths.
  3. Confirm in writing which mobile and API traffic is covered, and how, given those clients cannot solve browser challenges.
  4. Check whether authoritative DNS is inside the managed scope, and whether secondary DNS is included.
  5. Establish who changes rules at 03:00, their authority level, and the time-to-mitigate definition that applies to Layer 7 specifically.
  6. Ask what the underlying platform is and how many escalation hops sit between you and it.
  7. Request a redacted Layer 7 post-incident report as a sample deliverable before you sign.

If you are still mapping requirements before shortlisting, our overview of DDoS attack solutions and how they differ covers the architectural options in more detail. Effective application layer DDoS protection is rarely a product decision. It is a coverage decision, an authority decision and an evidence decision, and the estate that gets those three right will survive a request flood that flattens a better-funded competitor.

Frequently Asked Questions

What is the difference between application layer DDoS protection and network layer scrubbing?

Network-layer scrubbing removes volumetric and protocol attacks measured in bits and packets per second, usually by diverting traffic through a scrubbing centre. Application layer DDoS protection inspects HTTP and HTTPS requests, counts them per endpoint and per session, and decides which clients are genuine. A contract covering one does not necessarily cover the other, and the SLA clocks are often defined separately.

Can a WAF alone stop a Layer 7 DDoS attack?

Rarely. A WAF is built to recognise malicious payloads, and a request flood consists of well-formed, individually legitimate requests. Stopping it needs behavioural controls: session-level request budgets, challenges, bot scoring and cost-weighted rate limits on your most expensive endpoints. A WAF with those features enabled and tuned can do the job; a signature-only ruleset will not.

How do attackers find my origin IP and get past the proxy?

Through historical DNS records held by passive DNS services, mail headers from transactional email sent by the same host, certificate transparency logs that publish staging and admin hostnames, verbose error pages, and API endpoints pointed straight at the origin. The countermeasure is to restrict inbound traffic at the origin firewall to your provider’s published IP ranges and rotate the origin address after onboarding.

Does application layer DDoS protection cover APIs and mobile app traffic?

Only if it was scoped to. Browser challenges and JavaScript fingerprinting do nothing for clients that cannot execute JavaScript, so API and mobile paths need token-based limits, request cost budgets, schema and query depth validation, and signed or mutually authenticated requests. Ask the provider specifically how non-browser clients are handled, and check every subdomain is behind the edge.

What does managed application layer DDoS protection typically cost in the UK?

Pricing is usually assembled from clean bandwidth commitment, the number of protected domains or assets, request volume tiers and the incident support level, so published headline figures are hard to compare and change frequently; check current quotes directly. The more useful exercise is calculating your cost of downtime per hour during peak trading and testing the annual protection spend against that. Get each quote broken down by those four components so you are comparing the same coverage.



Hacktivist DDOS Attack Motives: What They Predict

Hacktivist DDOS Attack Motives: What They Predict

Hacktivist DDoS attack motives are listed in almost every security blog going: geopolitics, protest, revenge, clout within a channel. What almost none of them do is join the motive to the attack you actually receive at 09:00 on a Tuesday. That link matters, because motive is a forecasting tool. Once you accept that the attacker’s success metric is coverage rather than your revenue loss, the shape of the incident becomes predictable, and so does the list of surfaces that will fail first.

This piece is written for the people who sign the protection contract and run the incident bridge, not for policy analysts trying to map the ideology.

What actually drives hacktivist DDoS attack motives

Four drivers cover most of what UK organisations see. Political or geopolitical grievance, usually tied to a conflict, a sanctions decision or a government position. Protest against a named policy, planning decision or contract award. Retaliation for something a named executive or organisation said in public. And status, which is the one defenders underrate: in a coordinating channel with a few thousand subscribers, posting a screenshot of a downed council homepage earns reputation in a way that a quiet, damaging intrusion never will.

Attention is the objective. Not extortion, not competitive harm, not data. The campaign is built so that a claim can be posted, reposted and, ideally, picked up by a journalist who does not check it. That single fact explains the duration, the target list and the vectors.

Where the lines blur

Three complications are worth stating plainly. State-aligned groups adopt hacktivist branding because deniability is cheap and the aesthetic is established. Criminal crews borrow political language to muddy attribution or to recruit. And ransom demands now appear mid-campaign, sometimes days after a political claim, from the same or an adjacent account.

If you are working out what to do about a ransom DDoS attack, the technical response does not change: you mitigate, you do not pay, and you preserve evidence. The legal and reporting picture does change, because an extortion demand brings a different set of obligations and a different conversation with your insurer and your board. Treat every motive claim as unverified attribution, including the political ones. The group claiming your outage may not have caused it, and the group that caused it may not be the one you think.

Competitive sabotage and gaming disputes behave differently. Those attackers want an effect and do not want an audience, so they are quieter, more patient and more willing to run for hours. A hacktivist campaign that runs for six hours is unusual. A gaming grudge that runs for six hours is Tuesday.

How motive shapes the attack you actually see

Attention-driven campaigns are short and rhythmic. They cluster around a fixed point in time: a parliamentary vote, a court date, a contract announcement, a sanctions package, the anniversary of something. Waves of ten to thirty minutes, repeated, are far more common than sustained pressure, because a burst is enough to generate a screenshot from a public reachability checker and a burst costs less booter credit.

The toolkit is unglamorous. Rented booter and stresser capacity, reflection and amplification floods against the network edge, and plain HTTP GET floods pointed at whatever endpoint is most expensive to serve. Site search is the perennial favourite, followed by login pages and any URL with a query string that defeats the cache. The volunteer-tool era of Operation Payback, with participants running LOIC and HOIC from their own machines, has largely given way to rented botnet and stresser capacity coordinated through chat channels, which is why a handful of organisers can now generate more traffic than a few thousand volunteers once did.

Target selection follows the same logic as everything else. Homepages, public-facing portals, authoritative nameservers, anything with an address a reader will recognise. Not the claims processing system. Not the back-office integration that would genuinely hurt if it stopped.

Plenty of claimed campaigns sit well under 10 Gbps and well under an hour. That sounds survivable, and against a properly protected estate it is. The FBI’s Internet Crime Complaint Center made the point in a public notice on 4 November 2022, observing that hacktivist DDoS activity against critical infrastructure had produced limited operational impact while generating publicity out of proportion to the damage. The gap between impact and publicity is the thing to plan around. It is also why a modest flood still takes sites down: one unprotected surface is all the campaign needs, and modest is more than enough to saturate a registrar’s nameservers or a single origin VM.

Who gets picked, and why symbolism beats value

The recurring sectors will not surprise anyone: DDoS attacks on government websites and local council portals, NHS trusts and healthcare providers, airports and airlines, law firms acting on contested matters, broadcasters and news sites. High recognisability, public-facing, and easy to describe in a one-line post.

Collateral exposure is where organisations get caught out. Your payment page, your booking engine, your DNS provider and your CDN-hosted assets carry your brand and your reputation, but not necessarily your controls. When a third-party checkout goes dark, the screenshot still has your logo on it.

Supplier exposure works the same way. Organisations get targeted for a client they act for, a contract they won or a position their parent company took, rather than anything they did themselves. The attempted attacks on the Vatican’s website are a useful illustration of the pattern: a symbolic institution picked for what it represents, an attack claimed loudly, and an outcome rather less dramatic than the claim. Once a name appears on a circulated target list, unrelated participants join in simply because the list exists. Removal from the list is not a thing you can request.

Verifying a claim of responsibility against your own evidence

Here is the part no one else covers, and it is the defence that most often decides how the incident is reported. Hacktivist campaigns are optimised for narrative. If you cannot produce request rates, regional reachability and edge logs for the claimed window, a fifteen-minute partial slowdown gets written up as a day-long outage, and you are arguing from the back foot with your regulator, your insurer and the trade press.

Check three surfaces, in order:

  1. Authoritative DNS. Query your nameservers directly from multiple regions. If resolution failed, nothing downstream matters, and the web tier logs will look misleadingly quiet.
  2. Network and transport. Interface counters, upstream flow data, any scrubbing provider’s traffic graph for the window. Look for volume and for the vector mix.
  3. Application layer. Requests per second per endpoint, cache hit ratio, origin response times, 5xx rates. A GET flood on search shows up as a single endpoint carrying a request rate it has never carried before.

Then separate real impact from a reposted screenshot. Public checker tools report from one vantage point and cache aggressively; a red tick on such a site is not evidence of an outage. Synthetic monitoring from several regions, plus your own edge logs, is. Our 10-minute triage for telling a DDoS from an ordinary outage covers the sequence in more detail, and it is worth rehearsing before you need it.

Capture the evidence in the first hours, not the following week: precise timestamps in UTC with your local offset, vector breakdown, source ASNs and country spread, packet and request rates, the mitigation actions taken and when, and screenshots of the claiming post with its own timestamp. Insurers ask for it. Regulators ask for it. Any realistic legal route depends on it.

Ask your provider for a post-attack report and check the contract says what it must contain. Per-vector and per-ASN detail, start and end times, peak and sustained rates, and which rules fired. Where a reseller sits between you and the scrubbing network, that report often arrives late and thin, because the reseller is asking someone else for it too.

The defences that hold against attention-driven attacks

Burst-shaped protest traffic and on-demand mitigation are a poor fit. Detection, human decision, BGP announcement and route convergence all stack up, and a campaign built around a twenty-minute window can finish, be claimed and be screenshotted before your traffic ever reaches a scrubbing centre. Always-on for the symbolic hostnames, on-demand for the rest, is usually the honest compromise; the trade-offs in cost and latency are set out in our comparison of always-on versus on-demand DDoS protection.

Volume is rarely the reason a symbolic target falls over. Origin IP leakage is. Stale A records on a decommissioned subdomain, a mail or staging host on the same range, an origin address sitting in certificate transparency history from a certificate issued three years ago. A 5 Gbps direct-to-origin flood beats a proxy that was never bypassed at all. Audit your own DNS zone and CT logs before an attacker does, and lock the origin to accept traffic only from your provider’s ranges.

Authoritative DNS is the layer most often left unmanaged on exactly the sites hacktivists pick. Councils, small agencies and campaign microsites routinely run registrar-bundled nameservers with no anycast spread and no mitigation, so the nameservers fall before the web tier is even touched. Closing that gap is cheap relative to everything else you will spend, and our guide to DNS DDoS attack protection and the gaps most estates leave open lists what to check.

At the application layer, three controls do most of the work against protest traffic: rate limits on search and login with a sensible response for exceeded limits, full-page caching of the homepage and other high-traffic public pages so the origin is not touched, and a static fallback page hosted somewhere completely separate from your main infrastructure.

Finally, the contract. Managed should mean pre-attack tuning against your real traffic baseline, named escalation contacts on both sides, explicit authority for the provider to change policy without waiting for your sign-off, and a defined report. If nobody on the provider’s side can act at 03:00 without waking your CTO, you have bought monitoring, not management.

Preparing before your organisation becomes a symbol

Motive is predictive, so watch the triggers. Contract awards, public statements by executives, sanctions news touching your sector, court dates, planning votes, and sector-wide campaigns announced days in advance in open channels. A contested planning vote at 09:00 is a scheduled risk event, the same as a product launch.

Picture that council: an amplification flood against the network edge, an HTTP GET flood on the site search endpoint, and authoritative DNS sitting on registrar-bundled nameservers with no protection. The web tier might hold. The nameservers will not, and the outage will be total, which is the screenshot the campaign wanted.

Your comms plan should not feed the objective. Factual status updates on a status page hosted off your main infrastructure; no engagement with the claiming channel, no quoting it, no naming it; one named person who signs off wording; and an agreed line that describes impact and restoration without confirming attribution you have not verified. Resist the temptation to say “we repelled a major attack”if it was 4 Gbps for eleven minutes. Someone will check.

On the legal side, unauthorised acts impairing the operation of a computer are an offence under section 3 of the Computer Misuse Act 1990, as amended by the Police and Justice Act 2006. Report through Action Fraud, and use the National Cyber Security Centre reporting route where the incident is significant or touches critical services. Be realistic about prosecution: attribution across borders is hard and cases are slow, and what makes any outcome possible is the evidence you preserved in the first 24 hours. Our UK playbook for legal action after a DDoS attack sets out the sequence.

Keep the pre-attack checklist short enough that people actually do it: tested failover, a cached status page off your main infrastructure, a provider contact tree with out-of-hours numbers that someone has rung this quarter, and a rehearsed ten-minute triage. Read against the grain of the loud claims, hacktivist DDoS attack motives tell you to expect something short, noisy, symbolically aimed and technically ordinary, and to spend your money on the surfaces that fail quietly while everyone is watching the homepage.

Frequently Asked Questions

What motivates hacktivist DDoS attacks compared with criminal ones?

Hacktivists want attention: coverage, screenshots and status within a coordinating channel, usually tied to a political grievance, a policy, a contract or something someone said in public. Criminal attackers want money or a commercial effect, so they are quieter, more persistent and less interested in being seen. That difference shows up in duration, target choice and whether a claim is posted at all.

Are hacktivist DDoS attacks usually large, or is the volume overstated?

Claims are frequently overstated. Many campaigns run well under 10 Gbps and under an hour, and the FBI’s IC3 notice of 4 November 2022 observed that hacktivist DDoS activity against critical infrastructure produced limited operational impact while attracting outsized publicity. Small is still enough to take down unprotected authoritative DNS or a leaked origin address.

How can we tell whether a claimed attack actually affected our site?

Check authoritative DNS resolution, then network and transport counters, then per-endpoint request rates and error codes for the claimed window. Compare against multi-region synthetic monitoring rather than a public reachability checker, which reports from one vantage point. If your own telemetry shows no deviation, the claim is unsupported and you should say so with data rather than assertion.

Should we say anything publicly when a group claims an attack on us?

Publish factual status and restoration updates on a status page hosted separately from your main infrastructure, and say nothing that engages the claiming channel or amplifies its name. Do not confirm attribution you cannot verify. One named person should sign off all wording, and the line should describe user impact and timings, not adjectives.

Is launching a hacktivist DDoS attack illegal in the UK?

Yes. Deliberately impairing the operation of a computer without authorisation is an offence under section 3 of the Computer Misuse Act 1990, as amended by the Police and Justice Act 2006, and political motivation is not a defence. Participation using a booter service counts, as does supplying or operating one.

Does always-on protection make sense if attacks only last minutes?

For the hostnames most likely to be targeted, yes, precisely because they last minutes. On-demand diversion has to detect, decide, announce and converge, which can consume most of a twenty-minute burst. Running always-on for the symbolic public hostnames and on-demand for the wider estate is normally the sensible balance of cost and coverage.



DDOS or Outage? How to Tell in 10 Minutes

DDOS or Outage? How to Tell in 10 Minutes

The question every on-call engineer eventually asks, somewhere between the first alert and the first angry customer email, is whether they are looking at a DDoS or an outage. It matters more than almost anything else you decide in the first hour, because the two answers send you in opposite directions: one escalates to a scrubbing provider and an attack evidence pack, the other escalates to a supplier status page and your own change log. Guess wrong and you lose the hour. Ten minutes of disciplined triage is usually enough to avoid that, provided you know which signals actually discriminate and which ones fit a hundred unrelated faults.

Why the first ten minutes decide the rest of the incident

Paging a distributed denial-of-service (DDoS) mitigation provider for a failed deployment wastes the one team who could have rolled it back. Rolling back clean code while a botnet chews through your search endpoint wastes the window in which mitigation would have been cheapest to apply. Both mistakes are common, and both come from the same root cause: a single person looking at a single browser tab and reasoning outwards.

Cloudflare’s global outage on 18 November 2025 is the cleanest recent illustration. Large parts of the web returned errors simultaneously, social media immediately assumed a record-breaking attack, and Cloudflare’s own published incident report attributed it to an internal failure involving an oversized bot management configuration file, not to malicious traffic. From a UK office, a worldwide provider failure and a worldwide attack looked identical for the first several minutes. Plenty of teams spent that time on the wrong phone call.

Set the ground rule before the next incident, not during it. One named person owns the diagnosis and says out loud what they currently believe and why. Everyone else gathers evidence and reports it to that person. Diagnosis by group chat produces four confident theories and no decision.

The evidence that actually separates a DDoS from an outage

Vague symptom lists are useless here. “The site is slow”describes a volumetric flood, a saturated database connection pool, a mis-sized instance and a bad ORM query equally well. What separates them is the shape of the traffic and the fingerprint of the errors.

Traffic shape before the failure. In an attack, request or packet rate rises first and errors follow. In an outage or a capacity fault, traffic is flat or falling while errors climb, because the same visitors are arriving and being turned away. Pull the request-rate graph and the error-rate graph on the same time axis and look at which line moved first. That single overlay resolves more arguments than any other artefact.

Error fingerprints. Connection timeouts, SYNs with no completed handshake and half-open sessions point at the network and transport layers. Clean 502s and 504s served promptly by a healthy edge point upstream, at your origin or at something between the two. A wall of 403s or interstitial challenge pages is frequently your own mitigation: a rate limit set too tight, or a WAF rule someone shipped on a Friday afternoon.

Who is affected. Everybody at once, or one mobile network, or one geography, or one point of presence? An outage confined to a single POP or a single ASN is a provider routing problem far more often than it is an attack. Global and total, with no gradient, tends to mean something above the web stack: DNS, certificates, domain registration or routing.

Source diversity against payload sameness. This is the signature no capacity problem can imitate. Take a worked contrast. Forty thousand requests per second arriving from six thousand distinct autonomous systems, nearly all of them aimed at one expensive search endpoint with near-identical headers, is an attack; organic traffic never distributes like that. Flat request volume, clean 502s at the edge and a normal origin process count is an upstream or deploy failure wearing an attack’s clothing.

Screenshot early. Edge dashboards frequently aggregate fine-grained data after a few hours, and the per-second view you need for an evidence pack may be gone by the time you write the report.

Check three surfaces in order: DNS, network, application

Order matters, because a failure in the first surface produces symptoms in all three.

Authoritative DNS first

Authoritative DNS is the layer most often left unmanaged, inherited from whoever registered the domain, and it fails in a distinctive way: mail, APIs, SSO callbacks and third-party integrations all break at the same second as the website. If your payment webhooks and your Microsoft 365 mail flow died alongside the site, stop looking at the web tier.

Resolve your zone against several public resolvers (for example 1.1.1.1, 8.8.8.8 and 9.9.9.9), then query each of your authoritative nameservers directly by IP address and compare SOA serial numbers. Check the delegation the registrar actually publishes against the NS records in the zone; the two disagree more often than people expect after a migration. Teams that have not thought about this surface before should read a proper treatment of authoritative DNS resilience and what to demand from a provider while nothing is on fire.

Network and transport second

Is your prefix still being announced? A public looking glass or a route-collector view answers that in under a minute, and a withdrawn or leaked prefix produces total, instant, global loss that feels exactly like a terabit-class flood. If the prefix is up, run traceroutes from at least two networks outside your estate. Packets dying several hops upstream, at the same router, for everyone, is a transit problem. A saturated link and a dark link look different on an interface graph: one is pinned at line rate, the other is at zero.

Application layer third

Thread starvation is the great impersonator. A worker pool exhausted by one slow database query produces queueing, timeouts and rising latency that reads like an application-layer flood until you put request concurrency next to origin CPU. Attack: concurrency high, CPU high, request mix skewed to one or two endpoints. Capacity fault: concurrency high, CPU idle, everything waiting on a lock or a downstream call.

The cross-check that settles most disputes is the edge-versus-origin comparison. Does the origin see far more traffic than the edge forwarded? Or does it see almost nothing while the edge reports normal volumes? Either mismatch tells you more in thirty seconds than an hour of log grepping.

Outages that get misreported as attacks, and attacks mistaken for outages

DNS provider failure versus DNS flood. Both produce the same maddening pattern: some users fine, others seeing nothing, depending on whose resolver cache still holds a valid answer. The test is to query each authoritative nameserver directly from more than one network. Responses from some anycast locations and timeouts from others suggests attack traffic or a partial platform fault; uniform timeouts everywhere, from every vantage point, suggests the platform itself. There is more detail on staying reachable through a DNS provider outage or an attack on your zone for teams building that plan properly.

Origin IP leakage. If the proxy reports normal traffic while the origin is being hammered, the attacker has your real IP address. This is a more common route to a bypassed proxy than sheer volume, and the causes are mundane: historical DNS records, a mail server on the same host, an unproxied staging subdomain, a certificate transparency log entry. The fix is re-IPing the origin and restricting its firewall to the edge provider’s published ranges. Buying more scrubbing capacity does nothing, because the attack is not touching the scrubber.

The boring catastrophes. An expired TLS certificate and a lapsed domain registration both produce total, simultaneous, global failure that is indistinguishable from a massive attack for the first few minutes. Check the certificate chain and WHOIS expiry before you dial anyone. Control-plane and dashboard failures deserve the same scepticism: if you cannot log in to change anything, the platform may be broken even when the data plane is serving traffic fine.

Self-inflicted downtime. On-demand mitigation creates its own outage window. Time-to-mitigate is not just the vendor’s detection number; it includes human authorisation and BGP convergence, and a diversion triggered mid-incident can look to users like a second, separate failure while routes settle. Anyone weighing that trade-off should understand what the seconds in a time-to-mitigate SLA actually cover before treating the figure as a promise.

Low-and-slow attacks. Application-layer attacks that hold connections open barely register on a bandwidth graph, so they get filed as performance degradation and sit in a backlog for days. Watch concurrent connection counts and time-in-request rather than megabits per second. If connection counts are at ceiling while throughput is unremarkable, you are not looking at a capacity problem.

What to do once you have the answer

If it is an attack: find out, now, who is contractually permitted to trigger mitigation. “Managed”varies wildly. Some contracts let a named engineer on the provider’s side change policy without waking you; others require the customer to raise a ticket and confirm the attack first, which means your protection is only as fast as whoever is asleep with their phone on silent. If a human on the provider’s side cannot change policy at 03:00 without your sign-off, you have bought monitoring, not management. Know your resale chain too: if your supplier resells someone else’s scrubbing network, your escalation carries an extra hop and your evidence has to survive being retold by a first-line agent. That question belongs in a structured comparison of vendor claims at contract time, but it bites during triage.

If it is a provider outage: work out whether the failing component is the one that publishes your failover. Changing nameservers during a DNS provider outage is slow and sometimes impossible. A zone with 3600-second records means a nameserver change can take up to an hour to reach resolvers, which is precisely why TTLs are lowered days before a planned cutover and not during an incident.

If it is you: roll back cleanly, one change at a time, and resist the temptation to describe a bad deploy as “a sophisticated attack”in the status update. Customers forgive mistakes. Engineers at your customers’ companies read traceroutes, and they will notice.

Tell the board and your customers what you know, what you do not know yet, and when you will next update. Then insist on a written post-incident report. A credible attack report contains a timeline in UTC, a vector breakdown, peak figures in bits per second, packets per second and requests per second, the moment mitigation engaged, and how much traffic was dropped against how much was passed. A credible provider root cause analysis names the change, the blast radius and the preventative action. “Elevated error rates were observed”is not an RCA.

Build the runbook before you need it

The five checks, in order, each with an owner and a command or dashboard written next to it:

  1. Resolve the zone from three public resolvers and query each authoritative nameserver directly; compare SOA serials.
  2. Compare the registrar’s published delegation against the NS records in the zone, and check WHOIS expiry and the certificate chain.
  3. Confirm the prefix is announced, then traceroute from two external networks.
  4. Overlay edge request rate against origin request rate, and note any mismatch in either direction.
  5. Put application concurrency next to origin CPU and the top endpoints by request count.

Host that card somewhere outside the failure domain, along with out-of-band monitoring from an external vantage point; monitoring that shares a CDN, a DNS provider or a cloud region with production will go dark exactly when you need it. Keep phone numbers, not just email addresses, for the scrubbing provider, the host, the registrar and the DNS operator, and confirm annually that the out-of-hours numbers still reach a human. The UK’s National Cyber Security Centre publishes denial of service guidance that is a sensible baseline for preparation and reporting expectations.

Finally, work out your downtime cost per hour. That number decides whether always-on protection is worth its premium over an on-demand arrangement with a convergence delay, and it sets how much evidence and contractual commitment you are entitled to demand at purchase. Answering “DDoS or outage?”in ten minutes is mostly a matter of having decided, in advance, which five things you will look at and who will be looking at them.

Frequently Asked Questions

How can I tell if my site is down from a DDoS or an outage?

Put request rate and error rate on the same time axis. If traffic climbed before errors appeared, and the sources are spread across thousands of networks hitting a narrow set of endpoints, treat it as an attack. Flat or falling traffic with rising errors points at a provider failure, a capacity fault or your own recent change.

What are the first three checks to run when a website goes down?

Resolve your domain against several public resolvers and query your authoritative nameservers directly. Confirm your prefix is still announced and traceroute from outside your own network. Then compare what the edge says it forwarded with what the origin actually received. Certificate expiry and domain registration status are worth a ten-second look in the same pass.

Can a DNS provider outage look the same as a DDoS attack?

Yes, and the user-visible pattern is nearly identical: some visitors keep working on cached answers while others get nothing at all. Query each authoritative nameserver directly from two different networks. Uniform timeouts from every vantage point suggest a platform failure; partial responses that vary by location lean towards attack traffic or a degraded anycast footprint.

Why does my site go down when my DDoS proxy says traffic is normal?

Usually because the attacker found your origin IP address and is going around the proxy entirely. Old DNS records, mail hosts, staging subdomains and certificate transparency logs all leak it. Re-IP the origin and restrict its firewall to your edge provider’s published ranges; extra scrubbing capacity will not help with traffic that never reaches the scrubber.

Who should I contact first, my hosting provider or my DDoS provider?

Contact whoever owns the surface your triage implicates. Clean 5xx errors from a healthy edge with no traffic spike means the host or your own deploy; a verified flood means the mitigation provider. Check in advance who on the provider side is contractually permitted to trigger mitigation without your written confirmation, and whether they resell another network’s scrubbing capacity, because that adds a hop to every escalation.



DDOS Attack Penalties and Sentences in the UK Explained

DDOS Attack Penalties and Sentences in the UK Explained

A defendant who rents ten minutes of botnet capacity for the price of a takeaway, points it at a school’s exam portal and walks away thinking nothing will come of it is, on paper, exposed to one of the heaviest maximum penalties in English criminal law. In practice, most of them get a suspended sentence. That gap between the statutory ceiling and the real-world DDoS attack penalties and sentence outcomes is the part almost every guide skips, and it matters as much to the victim organisation as it does to the offender.

The short version: the law is severe, the charging rate is low, and the reason it is low is usually evidence. Not attribution. Evidence.

Which UK laws set DDoS attack penalties, and what the maximums are

The governing statute is the Computer Misuse Act 1990. Section 3 covers unauthorised acts with intent to impair, or recklessness as to impairing, the operation of a computer. That is the section a denial-of-service attack normally lands on, and it carries a maximum of ten years on indictment.

Denial of service was not always so clearly covered. A 2005 case involving a teenager who flooded his former employer’s mail server with emails ended in acquittal at first instance, and the Police and Justice Act 2006 amendments rewrote section 3 specifically to put impairment offences beyond argument. The wording now reaches temporary impairment, and recklessness is enough. You do not have to intend the outage.

Section 3A is the one that catches customers, not just operators. Making, adapting, supplying or offering to supply an article for use in a section 1, 3 or 3ZA offence is an offence; so is obtaining such an article with a view to its supply. Buying a subscription to a booter or stresser panel can engage section 3A, which carries a two-year maximum on indictment, where the article is obtained with a view to supplying it on; a customer who simply uses the panel is charged under sections 1 and 3 for the attacks themselves.

Then there is section 3ZA, inserted by the Serious Crime Act 2015. It applies where an unauthorised act causes, or creates a significant risk of, serious damage. The general maximum is fourteen years. Where the damage is to human welfare or national security, the maximum is life imprisonment. It has been used sparingly, and it is aimed at consequences a court can see: disruption to food or fuel supply, to health services, to transport, to systems of national importance.

Other offences stack. A ransom demand brings blackmail under section 21 of the Theft Act 1968, with a fourteen-year maximum. Proceeds of Crime Act 2002 confiscation proceedings follow criminal benefit, which for a booter operator means subscription revenue. Where a stresser site advertises itself as a legitimate load-testing service and takes card payments, Fraud Act 2006 charges can enter the picture too.

From statutory maximum to actual sentence: how courts decide

Here is the structural point most coverage misses. The Sentencing Council has no offence-specific guideline for Computer Misuse Act offences. Judges work from the General guideline: overarching principles, in force since 1 October 2019, which asks the court to assess culpability and harm, find a starting point by reference to the statutory maximum and comparable cases, then adjust.

Read that again from the victim’s side. Where there is no tariff table, the harm assessment is built largely from what the prosecution can put in front of the court, and the prosecution builds it from what you gave the police. A vague statement that “the website was down for a while and customers complained”produces a low harm finding. A reconstructed timeline with downtime to the minute, lost transaction volume, staff hours diverted and a named service that failed produces a different one.

Factors that push sentences towards custody are consistent across reported UK cases: repeated attacks over a sustained period, targeting of hospitals, schools, banks or emergency services, selling attacks for profit or running the panel rather than merely buying from it, and publicising the attack or the victim’s data afterwards.

Factors that regularly keep defendants out of prison are equally consistent. Youth. An early guilty plea, which under the Sentencing Council’s reduction guideline attracts credit of up to one third if entered at the first stage of proceedings. A diagnosis of autism or another neurodevelopmental condition, supported by a psychiatric report, which can affect both culpability and the court’s view of whether custody would be disproportionately damaging. No previous convictions. Real cooperation with investigators.

Put those together and the common outcome for a first-time individual offender who bought attacks rather than sold them is a suspended sentence, a community order with unpaid work, or a rehabilitation activity requirement. Custody becomes far more likely for panel operators, for repeat offenders who breach existing orders, and for anyone who attached a demand for money.

The penalties that are not a sentence at all

Ask anyone who has been through it and the sentence is rarely the worst part.

Devices get seized under PACE 1984 powers and forensically imaged. Phones, laptops, games consoles, the family router in some cases. Retention runs for as long as the material is needed for the investigation and any proceedings, which in a digital forensics backlog can mean many months. Bail conditions frequently restrict internet use or require it to be monitored.

Courts can impose a Serious Crime Prevention Order under the Serious Crime Act 2007, lasting up to five years, with terms restricting computer and network use, requiring disclosure of accounts and devices, and requiring notification of changes of address. Breach is itself an offence carrying up to five years. For anyone hoping to work in IT, an SCPO plus an unspent conviction under the Computer Misuse Act is close to disqualifying for roles that need security clearance or a clean DBS check.

The National Crime Agency’s Cyber Choices programme is the diversion route, and it is the reason a good number of teenage booter customers never see a courtroom. Regional Cyber Crime Units use it to engage young people identified in booter site user databases, often through a home visit rather than an arrest. Diversion stops being realistic once there is financial gain, once the targets include critical services, and once there has been a prior warning that was ignored.

Collateral consequences employers underestimate: vetting failures, loss of professional registration, refusal of US and other visas at the point of application, and named reporting in local press that outlives the conviction by years.

Ransom DDoS and hacktivist attacks: where sentences climb

A ransom demand changes the legal picture more than attack size does. Two hundred gigabits per second with no demand is a section 3 offence. Two gigabits per second with an unwarranted demand backed by menaces is section 3 plus blackmail plus a POCA confiscation route, and the sentencing arithmetic shifts accordingly. The history of organised cyber-extortion gangs receiving long custodial terms reflects exactly that: it is the extortion, not the packet rate, that drives the number.

There is a practical instruction buried in this for victims. The demand itself, the email, the note in a form submission, the message pasted into a support ticket, is often the single most useful piece of evidence you will ever hold. Preserve it verbatim with full headers. Do not delete it, do not forward it around and lose the original, and do not let a well-meaning support agent close the ticket.

Claimed political motive is not a defence. Hacktivist groups that announce attacks on government sites or NHS trusts sometimes seem to believe otherwise. Motive does shape how a court assesses harm, and attacks on public services push harm findings upward, because the people inconvenienced are patients and claimants rather than shareholders. Attribution of motive, though, should stay an open question in your own incident reporting; write what the traffic did, not who you think was behind it.

Paying rarely ends the campaign. Payment marks you as a payer, funds the next round, and complicates any later prosecution by introducing questions about the transaction itself and, for regulated firms, about sanctions exposure.

Why prosecutions are rare, and what that means for victims

Attribution is genuinely hard. Rented capacity from a booter or botnet-for-hire service means the source addresses belong to compromised devices and abused reflectors, not to the person who pressed the button. Add a VPN layer and cryptocurrency payment and the trail to a human being runs through several jurisdictions.

Jurisdiction is the second brake. The Computer Misuse Act has broad extraterritorial reach where there is a significant link to the UK, so an overseas offender attacking a UK business can in principle be prosecuted here. Mutual legal assistance requests take months, sometimes longer, and prosecutors make hard choices about which cases justify that effort. Coordinated operations do happen: the takedown of Webstresser.org in April 2018, run by Dutch police and Europol with NCA involvement, removed what was then one of the largest DDoS-for-hire services and led to action against users across several countries. The NCA also confirmed in March 2023 that it had been running fake booter sites to collect data on people trying to buy attacks.

The third brake, and the one you can actually influence, is the evidential threshold. The Crown Prosecution Service applies the Full Code Test: sufficient evidence for a realistic prospect of conviction, and a prosecution in the public interest. Patchy logging kills cases at the first limb. If you cannot show the court what arrived, when, from where and what it did, there is nothing to convict on regardless of how confident everyone is about who did it.

Set expectations accordingly. Compensation orders in these cases tend to be modest and constrained by the defendant’s means, which for a nineteen-year-old with no assets means very little. Civil recovery against an identified and solvent defendant is rare. Cyber insurance and business interruption cover, properly evidenced, usually matter far more to the balance sheet than the sentence does.

Building an evidence trail your DDoS provider can actually supply

This is where procurement decisions made eighteen months ago decide whether a prosecution is possible.

A usable attack report is not the PDF your account manager sends with a nice bandwidth graph and a congratulatory note. Sales-deck-grade summaries are worthless in court. What a prosecution needs is: timestamps accurate to the second and tied to a known time source; source address distribution and autonomous system breakdown; a vector breakdown separating, for example, UDP reflection from HTTP request floods; packet and request rates at peak and over time; every mitigation action taken and when; and residual impact on origin infrastructure. Plus a named engineer who can attest to all of it in a witness statement.

So ask the awkward questions before you sign, not after the incident:

  • How long are attack logs and flow records retained, and at what granularity after the first thirty days?
  • Is raw packet capture available on request, and is there a charge or a time limit on that request?
  • Who inside the provider is authorised to produce and sign a statement for police or civil proceedings, and has anyone there done it before?
  • Does the report cover DNS query traffic and application-layer requests, or only network-layer volumetrics?
  • What happens to the evidence if you terminate the contract mid-investigation?

Most buyers never raise any of this. They negotiate hard on time-to-mitigate SLA wording and never once ask what the provider can prove afterwards.

Two architectural gaps produce incidents with almost no usable evidence at all. The first is origin IP leakage. If an attacker has your real origin address, from an old DNS record, an SPF entry, a certificate transparency log or a misconfigured mail server, the traffic bypasses the scrubbing layer entirely and the only record is whatever your own edge kept, which is typically thin and rotated within days. The second is authoritative DNS sitting outside the protection contract, which happens more often than vendors admit. Knock out name resolution and the site is unreachable without a single packet touching the protected perimeter, and your provider’s report will show a quiet day.

On the reporting side: file with Action Fraud and keep the reference number, since it is what insurers and police forces both ask for. Escalate to the National Crime Agency where the incident affects critical services or has national impact. Notify the ICO only where personal data is implicated; a pure availability incident with no data involvement usually is not reportable, though the seventy-two hour clock under UK GDPR is unforgiving if it turns out to be. Internally, record who handled what and when, keep the original files rather than screenshots of them, and cost the downtime properly while the numbers are still retrievable. If you run an online shop, fold this into your first-hour incident playbook rather than treating it as paperwork for later.

UK penalties in international context

In the United States, DDoS offences run under the Computer Fraud and Abuse Act, 18 U.S.C. §1030. Federal sentences for booter operators have included custodial terms, supervised release with computer monitoring conditions, and restitution orders tied to documented victim losses. Restitution is worth noting, because it rewards exactly the kind of detailed loss quantification that also drives harm findings in an English court.

Australia’s Criminal Code Act 1995 sets a maximum of ten years for unauthorised impairment of electronic communication. Canada charges mischief in relation to computer data under section 430 of the Criminal Code, also with a ten-year indictable maximum. Across the EU, Directive 2013/40/EU on attacks against information systems requires member states to set maximums of at least two years, rising for botnet-enabled attacks and attacks on critical infrastructure. NIS2, the 2022 network and information security directive, is sometimes cited here but it regulates operators rather than punishing attackers; it imposes security duties and administrative fines on the organisations being attacked, which is a different instrument entirely.

The common thread across all of them is that maximums are high and prosecutions are comparatively few. Which leads to the one position worth holding firmly: legal deterrence has no place in a defence business case. Rented capacity, overseas infrastructure and mutual legal assistance timelines mean the prospect of prosecution protects nobody’s revenue on the day. What protects it is scrubbing capacity, time-to-mitigate, closed origin leakage and DNS inside the contract. Understanding UK DDoS attack penalties and how a sentence is actually reached is useful for setting expectations, for briefing the board, and for knowing what evidence to keep. It is not a control.

Frequently Asked Questions

What is the maximum sentence for a DDoS attack in the UK?

Section 3 of the Computer Misuse Act 1990 carries up to ten years on indictment for unauthorised acts impairing the operation of a computer. Section 3ZA, added by the Serious Crime Act 2015, raises that to fourteen years, or life imprisonment where the attack causes or risks serious damage to human welfare or national security. Actual sentences for individual offenders are usually far below these ceilings.

Is using a booter or stresser service a criminal offence?

Yes. Making, supplying or offering to supply an article for use in a Computer Misuse Act offence, or obtaining one with a view to its supply, is an offence under section 3A, with a two-year maximum on indictment, and launching the attacks themselves engages section 3. Paying a subscription to a stresser panel leaves a payment record and an account record, which is how law enforcement has identified customers after booter site takedowns.

Do first-time offenders go to prison for a DDoS attack?

Often not. Youth, an early guilty plea attracting credit of up to one third, no previous convictions, cooperation and supported neurodevelopmental assessments frequently combine to produce a suspended sentence or a community order with unpaid work. Immediate custody becomes much more likely where the defendant sold attacks, targeted healthcare or emergency services, or attached a ransom demand.

Can I sue the attacker or claim compensation after a DDoS attack?

In principle yes, but it is rarely worth it. Compensation orders in criminal proceedings are limited by the defendant’s means, and civil claims require an identified, solvent defendant within a practical jurisdiction. For most UK businesses, insurance recovery and contractual remedies against providers matter more, and both depend on the same downtime evidence a prosecution would need.

What evidence do UK police need before they will charge someone over a DDoS attack?

The CPS applies the Full Code Test, so there must be a realistic prospect of conviction on the available evidence. In practice that means second-level timestamps, source and vector data, mitigation records, proof of impact on your systems, and a witness who can attest to all of it. Any ransom demand should be preserved verbatim with full headers, since it is frequently the strongest single item in the file.



Legal Action After a DDOS Attack: A UK Playbook

Legal Action After a DDOS Attack: A UK Playbook

When a flood of junk traffic takes a UK company offline for six hours on a trading day, the questions arrive in a familiar order: what is happening, when does it stop, who did this, and can we do anything about it afterwards. Legal action after a DDoS attack is usually the last of those to be asked and the first to be quietly dropped. Not because the attack was lawful. It plainly was not. The problem is that by the time anyone asks the question properly, the flow records that would have supported a claim have already rotated out of a buffer, and the only surviving artefact is a screenshot of a dashboard with no timezone on it.

This piece is written from the target’s side of the incident. It covers what UK law actually offers a victim, what to preserve in the first day, who to notify, how ransom demands change the calculation, and why the contract you signed with your mitigation provider usually determines your legal position far more than the Computer Misuse Act does.

What UK law says about a distributed denial-of-service (DDoS) attack on your business

Three provisions matter. Section 3 of the Computer Misuse Act 1990 covers unauthorised acts with intent to impair the operation of a computer, which is the standard charge for knocking a service offline; it carries up to 10 years’ imprisonment on indictment. Section 3A covers making, supplying or obtaining articles for use in such offences, and it is the provision that catches booter and stresser services and the people who buy them, with a maximum of two years. Section 3ZA, inserted by the Serious Crime Act 2015, covers unauthorised acts causing or creating a significant risk of serious damage, and carries up to 14 years, rising to life where the damage touches human welfare or national security.

So the sentencing range is real. What it is not is a remedy. A conviction, when one happens, arrives months or years later, usually against a teenager who bought 30 minutes of attack traffic for the price of a takeaway, and it returns nothing to your balance sheet. UK courts can make compensation orders, but they are limited by what the defendant can actually pay, and booter customers are rarely solvent.

Criminal offence, civil wrong, contract breach: pick your fight

These are three separate tracks and they behave differently. A criminal prosecution is brought by the state, needs a suspect, and is not yours to control. A civil claim is yours to bring, but you must identify a defendant, serve them and enforce against assets. A contract claim is against a party you already know, usually your hosting, content delivery or scrubbing provider, and it is governed entirely by the words in the agreement you signed. Most organisations that talk about “taking legal action”are describing track one and end up, if anything happens at all, on track three.

Attribution, not illegality, is the obstacle

Nobody disputes that flooding a UK business is unlawful. The difficulty is naming who did it to the civil standard. Reflection and amplification attacks arrive from thousands of innocent third-party servers whose owners have no idea they are participating. Source addresses are routinely spoofed. Attack capacity is rented from a marketplace that takes cryptocurrency and hides behind its own proxy layer. As we have noted before, websites have long struggled to find meaningful legal recourse for denial of service attacks, and the reason is almost always evidential rather than doctrinal.

The first 24 hours: the evidence that keeps your options open

Everything below needs preserving before the next log rotation, not after the post-mortem meeting.

  • NetFlow, sFlow or IPFIX records from your edge routers, exported and copied off the collector;
  • Edge and origin web server access logs, plus firewall, load balancer and WAF counters for the attack window and for a comparable quiet period;
  • Monitoring and synthetic check alerts, status page updates, and the timestamps on each;
  • A full packet capture sample if one was taken, even a few seconds of it;
  • Internal records of who was notified, at what time, on which channel, and what decisions they took.

Log everything in UTC from NTP-synchronised systems. Mismatched clocks are the first thing an opponent challenges, and a two-minute drift between your load balancer and your provider’s scrubbing centre is enough to muddy a time-to-mitigate argument permanently.

Ask for the written attack report, not a screenshot

The single most useful document you will ever hold after an incident is your provider’s post-incident attack report: named vectors, peak bit rate and peak packet rate, source distribution by geography and autonomous system, and precise start and stop timestamps. If your traffic passes through a third-party proxy or scrubbing centre, that provider holds the only complete record of the flood. Your own logs show the hole, not the thing that made it.

Yet a great many contracts never promise that report. Make it a named deliverable with a delivery deadline before you sign, not a favour you request in week three while the account manager is on leave. The same applies to raw evidence requests: ask during procurement whose scrubbing capacity you are actually buying, because plenty of UK offerings are resold capacity on another operator’s network. Where that is the case, your SLA counterparty may have to go and ask an upstream party that has no contract with you at all. That chain is worth mapping alongside the rest of your vendor claim checks.

Ransom notes are exhibits

Keep the original email with full headers. Keep the chat transcript, the wallet address, the sample attack timing and any subsequent messages. Do not forward the note around the business and delete the original, which is what happens roughly every time, because a forwarded copy strips the headers that make it worth anything.

Who to report a DDoS attack to in the UK, and in what order

Start with Action Fraud, the reporting centre for fraud and cybercrime in England, Wales and Northern Ireland; in Scotland, report to Police Scotland on 101. What you get back is a crime reference number, and its value is administrative rather than investigative: insurers ask for it, regulators expect it, and customers asking awkward questions are reassured by it. Feeding into the National Crime Agency’s picture matters too, even when nobody investigates your individual case, because the pattern data is what supports booter takedowns.

The NCSC’s denial of service guidance is the sensible reference point for building a defensible response plan, and pointing to it in a board paper is more persuasive than an internal opinion.

Then work through the duties that carry deadlines:

  • NIS Regulations 2018: operators of essential services and relevant digital service providers have incident notification duties to their competent authority, and availability incidents count;
  • FCA operational resilience expectations: financial firms are expected to report operational incidents and to be able to show whether an important business service breached its impact tolerance;
  • UK GDPR: Article 32 treats availability as part of security, so loss of access to personal data can be a personal data breach, and Article 33 gives you 72 hours from becoming aware to assess and, where there is a risk to individuals, notify the ICO. Document the assessment even when you conclude no notification is needed;
  • Contractual notice clauses: customer and partner agreements often require notification within a small number of days, and those clauses bite long before any regulator does.

Ransom DDoS attack: what to do before anyone discusses paying

The reflex payment is the worst available option. It buys no guarantee the traffic stops, it marks you as a payer, and extortion groups have a documented habit of returning to previously compliant targets with a larger number. Before any of that, there are UK legal problems sitting behind the transaction.

Payments to a sanctioned person or entity breach financial sanctions, which carry strict civil liability and can attract monetary penalties from the Office of Financial Sanctions Implementation. Any payment also needs assessing against the money laundering offences in the Proceeds of Crime Act 2002. Screening the recipient is not optional diligence; it is the thing that determines whether the payment is lawful. Note also that in July 2022 the NCSC and the Information Commissioner wrote jointly to the Law Society making clear that paying does not reduce the risk to individuals, is not required by data protection law, and will not be treated by the ICO as a mitigating factor. Separately, the Home Office consulted in early 2025 on restricting ransom payments by public sector and critical national infrastructure bodies; check the current legal position before relying on anything written here.

Practical sequence: notify your insurer and broker before acting, because most cyber policies condition cover on prior consent and on using panel responders. Then follow a decision chain you wrote in advance, naming a director who owns the call, the lawyer who signs it off and the law enforcement contact who is told. Writing that chain during an attack, at 02:00, with the phones ringing, is how organisations make decisions they later cannot defend.

Suing the attacker versus claiming against your provider

Civil claims against attackers work in a narrow band of cases: identifiable commercial booter operations with reachable assets, domains or payment processors. Ubisoft’s 2021 action against a stresser operation is the usual illustration, reported as producing an award of just over $153,000 alongside site takedowns. The useful lesson is not the sum. It is that the defendant was a business with a website and a payment flow, not an anonymous customer. Against individual botnet users overseas, the cost of identification, service and enforcement will exceed anything you recover.

Claims against your hosting, CDN or scrubbing provider look more promising and usually deliver less than expected. SLA credits are typically a percentage of one month’s fee, claimable only inside a notice window of around 30 days, and sit beneath a liability cap tied to annual charges, with consequential loss excluded outright. Downtime, lost sales and reputational harm are exactly what those exclusions remove. Credits and damages are different animals; treating a credit as compensation is a category error that has cost boards a lot of wasted legal spend.

Which leaves insurance doing most of the real work. Business interruption and cyber policies commonly apply a waiting period measured in hours, so a four-hour outage may recover nothing while an eleven-hour one recovers a great deal. Loss adjusters want a defensible figure: hourly revenue derived from comparable trading periods, staff time at loaded cost, recovery and third-party response fees, and contractual penalties triggered by the outage.

Why the contract you signed decides how strong your position is

Four clauses do most of the damage, and they are all checkable before you buy.

What “managed”actually includes. Managed should mean onboarding and rule tuning records, a named escalation path, an engineer empowered to change policy during an attack without waiting for your sign-off, and a committed written attack report. Absent those, you have bought monitoring, not management.

When the clock starts. On-demand cover almost always measures time-to-mitigate from your notification, which turns your own out-of-band notification trail into evidence: timestamped emails from a mailbox that is not on the affected domain, call logs, ticket IDs. Teams forget this while firefighting. If you are weighing always-on against on-demand cover, understand that the difference is partly evidential, and read the small print on what those SLA seconds measure.

Three surfaces, not one. Network and transport, application layer, and authoritative DNS. The third is frequently outside the DDoS contract entirely, which means an outage at that layer can fall into nobody’s SLA while still being the reason customers saw an error page. Establish who covers authoritative DNS, under what commitment, and what report you receive if it fails.

Origin IP leakage. This is the claim-killer. A stale A record on an old subdomain, a mail host sharing the origin address, a staging environment nobody decommissioned: any of these lets the flood reach your origin directly, outside the protected path. When that happens the provider will say so in writing, correctly, and the SLA never applied. Origin leakage, rather than raw attack volume, is the most common reason a proxy gets bypassed and the most common reason a claim against the vendor collapses. Audit your DNS zone for it while things are calm.

Frequently Asked Questions

Is a DDoS attack a criminal offence in the UK?

Yes. Section 3 of the Computer Misuse Act 1990 covers unauthorised acts intended to impair the operation of a computer, with a maximum of 10 years on indictment. Buying or supplying a booter or stresser service falls under section 3A, and section 3ZA covers attacks causing serious damage, carrying up to 14 years or life in the most severe cases.

Can you sue someone for a DDoS attack?

You can, provided you can identify and serve a defendant with assets worth pursuing. Civil action has succeeded against commercial booter operators, as in Ubisoft’s 2021 case reported at just over $153,000 plus takedowns. Against anonymous or overseas individuals, the cost of attribution and enforcement generally outweighs anything recoverable.

Who should you report a DDoS attack to in the UK?

Report to Action Fraud for a crime reference number, or to Police Scotland on 101 if you are in Scotland. Then work through sector duties: NIS Regulations notification if you are an operator of essential services or a relevant digital service provider, FCA reporting for financial firms, and an Article 33 assessment for the ICO where personal data availability was affected.

Does a DDoS attack have to be reported to the ICO?

Not automatically, but it can be reportable. UK GDPR Article 32 treats availability as part of security, so if people lost access to personal data and there is a risk to their rights and freedoms, Article 33 requires notification within 72 hours of becoming aware. Record the assessment and its reasoning even where you decide notification is not required.

Should you pay a ransom DDoS demand?

Paying is the weakest option and carries its own legal exposure, including financial sanctions liability and the money laundering offences in the Proceeds of Crime Act 2002. It guarantees nothing and marks you as a payer. Notify your insurer and law enforcement first, and make the decision through a chain you agreed in writing before the attack rather than during it.



Authoritative DNS DDOS Protection: A Buyer's Guide

Authoritative DNS DDOS Protection: A Buyer’s Guide

A UK retailer can have its web front end behind a reverse proxy, a signed scrubbing contract with a named escalation matrix, a web application firewall tuned over months, and still go completely dark for two hours because two nameservers in the same rack stopped answering queries. The firewall logs will look healthy. The scrubbing dashboard will show nothing. Authoritative DNS DDoS protection is the part of the estate most buyers assume is included in something else, and it almost never is.

Authoritative DNS is the service that answers “what is the address for this name”for zones you control. Not the resolver your laptop talks to. The servers listed in your NS records, the ones every recursive resolver on the internet eventually has to reach. Take them offline and the name stops existing, whatever else is still running.

Why authoritative DNS fails differently from your website

What actually stops when the nameservers stop

A website outage is visible and bounded. A delegation outage is broader than most incident plans assume: inbound mail stops because sending servers cannot resolve your MX records; API clients fail on lookup rather than on connection; VPN concentrators become unreachable to remote staff resolving the endpoint hostname; SaaS single sign-on breaks in both directions as identity providers and service providers try to reach each other by name; and payment provider callbacks to your webhook endpoints fail silently, which usually surfaces later as a reconciliation problem rather than an alert.

Support desks feel it before monitoring does. Staff report “the internet is down”, which sends the first responders looking at connectivity instead of at the zone.

TTLs decide whether you notice in an hour or in a minute

Resolver caching is the only shock absorber you get. A record with a time-to-live (TTL) of 3600 seconds sits in resolver caches for up to an hour, so an authoritative outage may be invisible to a large share of users while you recover. Set the same record to 300 seconds because you wanted fast failover, and caches expire five minutes into the attack. Resolvers then come back for fresh answers, find nobody home, and the outage is immediate and total.

That is a genuine trade-off, not a best practice with one right answer. Long TTLs buy grace and take away your ability to move traffic quickly under pressure. Short TTLs do the reverse. Most estates end up with a split: 3600 seconds on stable A and MX records, 300 seconds only on the handful of records involved in a planned failover, with the low values set in advance of a change window rather than left permanently low.

The DNS version of origin IP leakage

Origin leakage is a familiar failure: the web estate hides behind a proxy, but the origin address is discoverable, so the attacker skips the proxy. The same pattern repeats one layer down, and it is more common than the web version. The front end is proxied and filtered. The NS records still point at ns1 and ns2 on the same unfiltered transit, frequently in the same rack, sometimes in the same /24. An attacker reading the delegation does not need to find the origin. It is published.

This is the single most useful check in the whole exercise, and it takes thirty seconds. Query your NS records, resolve the nameserver hostnames, and ask whether those addresses sit behind the same protection you bought for the website. If they do not, the scrubbing contract is protecting the part of the estate nobody needs to attack. Our earlier piece on the gaps that commonly remain open on DNS infrastructure covers the operational side of that audit.

The attack patterns authoritative DNS protection has to survive

Direct query floods over UDP and TCP

The straightforward case is volume: spoofed UDP queries crafted to resemble ordinary recursive traffic, aimed at your nameserver addresses. Because the source addresses are forged and the queries are well formed, signature matching helps less than capacity and per-source behavioural limits do.

TCP query floods get overlooked. DNS over TCP is a requirement, not an edge case, as set out in RFC 7766, and resolvers fall back to TCP routinely for large responses. An attacker opening connections and abandoning them exhausts connection state long before it exhausts bandwidth. Ask any prospective provider how it handles TCP query state separately from UDP volume. The vague answers are informative.

Random subdomain floods break the usual blocking reflex

Water torture attacks query nonexistent labels under your zone at high rates: a random string, then your domain. The queries arrive at your authoritative servers through legitimate recursive resolvers, because that is how the internet works. Your servers do the NXDOMAIN work, and if DNSSEC is in play, the negative answers cost more to produce.

The instinct is to block the sources. Do that and you have blocked BT’s resolvers, Sky’s resolvers and whichever public resolver a third of your customers use. The meaningful procurement questions are narrower: how does the platform absorb NXDOMAIN load, can it rate limit on label patterns rather than source addresses, and will it show you the top queried labels after the event so you can prove what happened? Response rate limiting in BIND, NSD and Knot helps on self-hosted servers, but it is a blunt instrument against traffic arriving via shared resolvers.

Your zone as somebody else’s weapon

The other direction matters for reputation and for your own capacity. Large ANY or TXT responses make your nameservers a useful reflector: an attacker spoofs a victim’s address, sends small queries, and your servers deliver the amplification. RFC 8482, published in January 2019, defines minimal-sized responses to ANY queries precisely to close that down. Check whether your provider implements it, and check what your TXT records have accumulated over the years. Old SPF fragments and abandoned verification strings add up.

Delegation failures that look like an attack

Some DNS outages are control failures wearing an attack costume. Hijacked NS records after a registrar account compromise. A domain that expired because the renewal invoice went to a departed employee. A DNSSEC key rollover where the DS record at the registrar no longer matches the signing key at the provider, which makes validating resolvers return SERVFAIL for a zone that is publishing perfectly good answers.

For generic top-level domains, registrar-level EPP statuses such as clientUpdateProhibited and clientTransferProhibited are the cheapest control you can apply. Nominet runs.uk under its own rules, so ask your registrar what lock equivalents it supports rather than assuming the gTLD status codes apply. And remember where the DS record lives: at the registrar, in the parent zone, not with your DNS provider. That split is what turns provider migrations into multi-day incidents.

Deployment models compared: where each one fits

Managed anycast DNS as a hosted service

You hand over the zone and inherit a global anycast footprint immediately. Capacity gain is the fastest available. What you give up is granularity: you rarely choose the rate-limiting thresholds, you get the logging the platform offers, and your ability to change records during an incident depends entirely on that provider’s portal and application programming interface (API) staying up.

Self-hosted nameservers behind BGP scrubbing or hosting-level filtering

Full control of software versions, response policy, rate limiting and logs. The catch is timing. On-demand mitigation fits nameservers badly, and diversion time is only half of the problem. If your records carry 300 second TTLs, resolvers come back for answers during the exact window you are still moving routes and settling the scrubbing path. Always-on is usually the honest answer for the DNS surface, whatever you decide for web traffic. The wider trade-off is covered in our comparison of always-on and on-demand mitigation models, and the measurement problem in our piece on what time-to-mitigate figures in an SLA really mean.

Dual-provider authoritative DNS with a hidden primary

The stronger architecture, and the one most organisations with real availability obligations end up at: a primary server you control, not published in the NS set, transferring the zone by AXFR and IXFR to two independent public secondary networks. Both providers answer queries. Neither one holds your only copy of the zone or your only editing path.

It costs discipline. Transfer monitoring, TSIG key management, DNSSEC handled either by signing at the hidden primary or by keeping both providers aligned, and a habit of checking that both NS sets serve the same serial. Compare that with the common single-provider setup where one portal outage removes both resolution and your ability to change anything. October 2016 is still the reference case: the Mirai-driven DNS provider outage attack pattern that hit Dyn took large numbers of otherwise healthy sites off the internet, and Dyn’s own incident write-up, published later that month, described tens of millions of discrete IP addresses associated with the botnet traffic. The sites were fine. The delegation was not.

Matching the model to the estate

Single-site ecommerce with one zone and a small team: managed anycast, always-on, with the registrar locked. Multi-tenant hosting or a data centre carrying customer zones: dual-provider or self-hosted with always-on filtering, because your customers’ NS records are your reputation. Healthcare, government services and anyone with regulatory availability expectations: dual-provider with a hidden primary, and a tested delegation rollback, because “our supplier was attacked”is not a defence that survives an availability review.

What ‘managed’ actually buys on the DNS surface

Pin down four things in writing, because sales decks cover none of them properly: onboarding and zone import, including who validates parity after the import; tuning of rate limits and query filters, and whether you can request changes; the escalation path during an attack, with named contacts and out-of-hours cover; and who is permitted to change records while an attack is in progress.

That last point is where recovery actually stalls. If the portal is degraded, is there an API? If there is an API, what is its rate limit when you need to push forty record changes at 02:00? Will the provider act on your behalf without sign-off, and is that authority written down? If nobody on their side can change policy or a record out of hours without your director’s approval, you have bought monitoring, not management.

Reporting quality is the second tell. A one-line “we mitigated 40Gbps for you”is useless on DNS. Ask to see a sample report before you sign, and look for queries per second over time, NXDOMAIN ratio against baseline, top queried labels, query type breakdown and a source resolver breakdown. If the provider cannot produce that shape of report, it cannot diagnose a water torture attack either.

Then trace the network. Provider diversity is frequently illusory. Two separately branded DNS services can resolve back to the same anycast footprint or the same upstream scrubbing partner, which means your carefully designed redundancy shares a single failure domain. Ask which network operates the points of presence, which autonomous system numbers announce the anycast prefixes, and whether any part of the mitigation is subcontracted. Resale is not a scandal, but you should know you are buying it. Our guide to choosing managed DDoS protection in the UK goes further into how those resale chains are structured and priced. Law firms weighing these same resale chains will find sector-specific buyer advice in our piece on keeping client portals, DNS and websites online beyond phishing.

Evidence to demand before you sign

  • Capacity in queries per second, not just Tbps. Terabits describe a pipe; nameservers fall over on query rate and on NXDOMAIN work. Ask for the qps figure, how it was measured, and whether that headroom is per customer or shared across the platform.
  • An SLA that covers query response availability. Portal uptime is not resolution uptime. Read what the credit pays against, then compare it with your own downtime cost per hour. Most credits are rounding errors by that measure.
  • Time-to-mitigate stated for the DNS layer specifically, with always-on versus on-demand made explicit and your TTL values factored into the conversation.
  • Control checks. Registrar lock status, who holds the DNSSEC signing keys, whether the provider supports a hidden primary and inbound zone transfers, and a documented, tested rollback of the delegation.

Costs, business case and a safe cutover

UK pricing on this surface tends to follow one of three shapes: per zone with a query allowance, per million queries with overage, or bundled into an existing scrubbing or proxy contract at a marginal rate. Overage is where the surprises live, because an attack generates query volume you did not plan for. Ask whether attack traffic is billable. Pricing on managed DNS moves, so confirm current figures directly with the provider rather than working from anything published last year.

Build the case from your own numbers, not from headline attack sizes. Lost orders per hour from your own order data, staff hours idled, SLA credits you would owe your own customers, and the support volume an outage generates for weeks afterwards. Set that against annual protection spend plus plausible overage. The first-hour ecommerce response playbook is a useful companion for working out what an hour actually costs you.

The cutover itself breaks more zones than attacks do. A sequence that works: run a full record parity check between old and new providers and diff the output; lower TTLs on the records you are moving several days ahead, and wait out the old TTL; add the second NS set at the registrar while keeping the first; watch resolution from several independent networks and public resolvers, not from your office; then restore longer TTLs once things are stable. If DNSSEC is signed, plan the DS record change separately and do not remove the old keys until validating resolvers have picked up the new chain.

Afterwards, keep three checks running: external resolution from multiple networks, zone transfer health and serial agreement between providers, and DS record consistency against what your provider is publishing. Authoritative DNS DDoS protection is bought once and verified continuously, and the verification is what separates an estate that stays reachable from one that discovers its delegation problem during the incident. More background on attack infrastructure and defender priorities is collected across the DDoSInfo archive.

Frequently Asked Questions

What is the difference between protecting authoritative DNS and protecting recursive DNS?

Authoritative DNS answers queries about zones you own, so an outage makes your domain unreachable to everyone on the internet. Recursive DNS is the resolver service your users and servers query, so an outage there affects your own people’s ability to reach anything. Both need protection, but the blast radius and the buying decision are different: authoritative is a public-facing availability problem, recursive is an internal service problem.

Does a reverse proxy or CDN already give me authoritative DNS DDoS protection?

Only if you have moved your authoritative nameservers to that provider as well. A proxy in front of your web origin does nothing for queries aimed at the addresses in your NS records. Check the delegation: resolve your nameserver hostnames and confirm those addresses sit behind filtering. If they point at self-hosted servers on ordinary transit, the protected front end is not the exposed surface.

Is always-on mitigation necessary for nameservers, or will on-demand do?

For authoritative DNS, always-on is usually the right answer. On-demand requires detection plus diversion time, and if your records carry short TTLs for failover, resolver caches expire during that window and the outage becomes immediate rather than gradual. On-demand can be defensible for a web estate with long cache lifetimes; it fits the delegation badly.

Do two DNS providers actually make me safer, and how do I check they are independent?

Two providers remove single-provider dependency for both resolution and record editing, which is the failure the October 2016 Dyn incident illustrated. They only help if they are genuinely separate. Ask each provider which network operates its anycast points of presence, which autonomous systems announce the prefixes, and whether mitigation is subcontracted to a third party; shared upstreams mean shared failure.

How does DNSSEC affect DDoS protection and failover between providers?

DNSSEC adds signing work and larger responses, which raises the cost of NXDOMAIN floods against your zone, and it makes key handling part of your availability design. The DS record lives at the registrar in the parent zone, not at your DNS provider, so a mismatch between the published DS and the active signing key causes validating resolvers to fail the zone outright. Multi-provider DNSSEC works, most reliably with signing done at a hidden primary you control, but treat every key rollover as a change with its own rollback plan.