How to protect against massive DDOS? (250 mio requests in 3 days)

Hello,

I hope, I am right in this forum.

Recently I had an massive DDOS-Attacke over 3 days with round about 250 mio requests. Even cloudflare (free mode) could not handle it at all and approx. 20 mio requests reached my server. So the site was down for 3 days and I lost the traffic and with this of course the money.

So I want to know how I can protect me against such DDOS? My coder said that the attacks came from many different countries all over the world. On a scale from 1 (script kiddie) to 10 (elite hacker), the attack was a 5 he said.

So what would you do and how much will it cost to protect me from that? Can you advise any good service to me? WPengine seems to be good, but they say I had to take the scale package for about 220 dollars per month. That seems to much for me.

OVH has good DDoS protection on their VPS - might be worth asking their support. Perhaps ask cloudflare about their premium package?

@jazzc has suggested these services previously
https://www.stackpath.com/web-application-firewall/
https://www.voxility.com/anti-ddos

I recommend you use blazingfast.io, kms-hosting.com and flokinet.is they can handle with these bigs attacks. Just buy a Hosting with ddos protection from Voxility / core-backbone.

You will be fine on kms-hosting and myvirtualserver.de. Like I said, you can protect your website choosing a good hosting provider like I mention here.

If your hosting doesn't have any ddos filter, you should move to one with good anti-ddos filter. Seriously, you can't protect anything without hardware firewall on the hosting provider network.

Move your website right now.

Thank you all for your good answers!

My hoster (altus) does say he has DDOS protection included but it didnt help. Because I paid much money in the fund of this hoster on my account recently I have to stay there a while. So I am looking for a good DDOS protection service like Cloudflare. But its premium service costs 200 Dollar per month and that is too much for me. Maybe someone have a good alternative solution for this issue?

Voxility want at least 500 (!) Dollar per month. Stackpath has good prices - am I right that they offer a full hosting service including DDOS? Because of the paid fund at my currently hoster I am looking for a DDOS service like cloudflare to protect me.

Why not just use the free Cloudflare protection? Even the free service has decent DDOS protection, It's saved a couple of my sites before.

Well, the DDOS hostings know that you are lost without such a protection, and for people/company who really value their businesses its a ok price. The problem is when you are in the middle, where hackers want to push you down, but you don't have budget to get good firewall. You can't really do anything. Now days this goes more and more popular on the underworld to blackmail businesses even for millions. You know early in the real world the people who come and say, you pay us to protect you or we will take your money and beat you up, kind of made it virtually.
My suggestion is to get DDOS hosting with hardware firewall, get a cloud like amazon or google cloud, it will be much harder to get this down. Maybe you will pay a little more, maybe even cheaper, but you have better solution.

I'd suggest to use OVH, They have good DDos protection with their server.

Unfortunately you are going to have to pay decent money to migrate the attack. Going to some cheap or free provider wont work. If this indeed is a large ddos attack, you better fork money if you want it blocked.

blacksails said:

Thank you all for your good answers!

My hoster (altus) does say he has DDOS protection included but it didnt help. Because I paid much money in the fund of this hoster on my account recently I have to stay there a while. So I am looking for a good DDOS protection service like Cloudflare. But its premium service costs 200 Dollar per month and that is too much for me. Maybe someone have a good alternative solution for this issue?

Voxility want at least 500 (!) Dollar per month. Stackpath has good prices - am I right that they offer a full hosting service including DDOS? Because of the paid fund at my currently hoster I am looking for a DDOS service like cloudflare to protect me.

Click to expand...

Be careful, not all anti-ddos protection are great, you should see the capacity of amount that your anti-ddos of your hosting is able to mitigate. You can protect your website buying anti-ddos reverse proxies.

Blazingfast.io have reverse proxies with ddos protection for 25€ / month is the most cheap you can find, or search for "DDoS Protection reverse proxy" in Google.
But before order or buy, check if they are able to mitigate and handle with 20-100Gbps of DDoS Attack.

Like I said, not all anti-ddos protection are great, some of them can't handle with big attack others can do it, others not. It depends on hosting provider. Unfortunatly you need to move or buying a anti-ddos reverse proxy. I suggest you to use Blazingfast.io reverse proxies.