How DDoS Protection Works at Power Down

What is a DDoS Attack?

A Distributed Denial-of-Service (DDoS) attack floods your server with malicious traffic from thousands of compromised machines, exhausting bandwidth or CPU resources until legitimate users can no longer connect.

Types of DDoS Attacks

Type	Layer	Example
Volumetric	L3/L4	UDP floods, ICMP floods — fill up your bandwidth
Protocol	L4	SYN floods, ACK floods — exhaust server state tables
Application	L7	HTTP floods, slowloris — target your web app logic

Power Down's Protection Architecture

Layer 1: Upstream Scrubbing Centers

All Power Down servers are connected to high-capacity scrubbing infrastructure. Volumetric and protocol attacks are automatically detected at the network edge — before traffic ever reaches your server. Scrubbing capacity exceeds 1 Tbps.

Layer 2: Cloudflare Magic Transit

Premium plans use Cloudflare Magic Transit, which routes your IP traffic through Cloudflare's Anycast network. This provides sub-second mitigation, global scrubbing, and protects against even the most sophisticated L3/L4 attacks.

Layer 3: Application Layer (Your Responsibility)

Layer 7 attacks (targeting your web app) require application-level defenses:

• Cloudflare proxy — free tier protects websites, enables WAF and rate limiting
• Nginx rate limiting — limit requests per IP using limit_req_zone
• fail2ban — auto-ban IPs making excessive requests
• Web Application Firewall (WAF) — filter malicious HTTP patterns

Nginx Rate Limiting

http {
  # Define rate limit zone — 10 req/sec per IP
  limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

  server {
    location /api/ {
      limit_req zone=mylimit burst=20 nodelay;
      limit_req_status 429;
    }
  }
}

What to Do During an Attack

1. Check your bandwidth graph in VirtFusion — confirm it's a DDoS
2. Enable Cloudflare "Under Attack" mode (Security → Settings)
3. Use netstat -an | awk '{print $5}' | sort | uniq -c | sort -rn | head to find top source IPs
4. Block individual IPs: ufw deny from ATTACK_IP
5. Open a support ticket with your server IP and attack description

Null-Routing

If an attack exceeds scrubbing capacity and threatens network stability, Power Down may temporarily null-route (blackhole) your IP. This blocks all traffic to the IP — including legitimate users. It's a last resort. Contact support immediately if you believe your IP has been null-routed.