DDoS attack: what it is and how to protect your website from attackers

Imagine that your online store suddenly stops responding to user clicks. Orders freeze, page loading times increase from seconds to minutes. Customers flood the chat with complaints, but there is no technical error — the server is simply bombarded with requests from unknown sources. This is a DDoS attack, one of the most powerful tools of digital sabotage that can shut down a business in minutes. At stake are not only lost orders, but also the company’s reputation and customer trust.

The good news is that for most companies, this is not “hacker magic,” but rather a clear technical risk that can be controlled and minimized, especially if the IT infrastructure is located in reliable data centers with specialized protection. Modern solutions, such as AntiDDoS based on Red Guardian from Hostpark, allow you to detect and neutralize attacks at the network infrastructure level, long before they reach your server.

What is a DDoS attack?

To understand how to combat DDoS, you first need to understand the phenomenon itself. A DDoS attack, or Distributed Denial of Service, is a targeted “flooding” of your website or service with a huge number of requests from many devices at the same time. At first glance, it sounds simple, but the mechanism behind it extends to the entire depth of your infrastructure.

The goal of such an attack is monolithic and harsh: to overload the server, communication channel, or individual service so that legitimate users cannot access the resource. As a result, the site becomes slow, unstable, or completely inaccessible. For a business, this is a disaster. Hours of downtime mean lost orders, a flood of complaints on social media, a drop in conversion metrics, and, worst of all, a loss of trust from customers who may switch to competitors.

How a DDoS attack works technically

On a technical level, a DDoS attack is organized as follows: an attacker gains control over a large number of devices (often through infected computers, server botnets, or rented computing resources). At a predetermined moment, all these devices simultaneously begin sending requests to your website or server. The number of these requests is disproportionate to the normal load—instead of 100 requests per second, the server receives 10, 50, or 100 thousand.

Your website’s infrastructure is designed for a certain level of load. When this level is exceeded repeatedly, the server, network equipment, and communication channel begin to suffocate. The request queue overflows, processes freeze, memory is depleted, and as a result, there are simply no resources to serve new customers.

The key problem is that malicious traffic looks as similar as possible to normal traffic. It is not some strange code or obvious example of intrusion — it is simply a huge number of normal HTTP requests or network packets coming from many different IP addresses. Such traffic is very difficult to filter using simple means such as basic firewalls or antivirus systems.

The difference between DoS and DDoS attacks

The terms “DoS” and “DDoS” are often confused, but the difference between them is significant and indicates the complexity of the attack. A DoS (Denial of Service) attack is carried out from a single source — a single server, a single computer, or a single subnet of IP addresses. Although such an attack can still cause damage, it is relatively easier to detect and block, since all suspicious traffic comes from one place and can be tracked by geolocation, AS number (autonomous system of the provider), or subnet.

A DDoS (Distributed DoS) attack is fundamentally different in its distributed nature. The attack comes from hundreds, thousands, or even millions of different devices simultaneously. Traffic comes from different regions, different providers, and different AS numbers. At first glance, it looks like a sudden surge in popularity for your site, as if it has suddenly gone viral. Only with a deep analysis of the traffic, its signatures, and behavior does it become clear that this is an organized attack, not a normal traffic surge.

It is precisely this distributed nature that makes DDoS attacks so difficult to detect, analyze, and neutralize. That is why traditional protection methods often prove ineffective.

Where do DDoS attacks originate?

When people hear about DDoS attacks, they often imagine a “brilliant hacker in a hoodie” sitting alone in a room under the glow of monitors, controlling a global network of malicious computers. The reality is much more prosaic. Modern DDoS attacks are launched through accessible and often legal channels: botnets, infected devices, rented computing resources, and even services officially positioned as testing tools.

Botnets and “zombie computers”

A botnet is a concept that both requires explanation and causes concern. Essentially, it is a network of compromised devices that are remotely controlled by a malicious actor without the knowledge of their owners. A Trojan, worm, or virus can infect a user’s computer, often disguised as a useful program, advertising module, or even an update. The owner may not notice that the device is infected for a long time—the computer is just a little slower, a little hotter, but this can be attributed to normal wear and tear.

At the right moment, the botnet operator gives the command: all infected machines start attacking a specific website. Millions of computers around the world simultaneously start sending requests, and the website crashes under a tsunami of traffic.

Real-world examples of botnets demonstrate the scale of this phenomenon. Historically, the most notorious botnets consisted of several million machines and were regularly used over the years to attack large portals, government institutions, and providers. The problem has become even more acute with the development of the IoT (Internet of Things). Surveillance cameras, routers, smart devices, data recording servers—all of these devices often have weak default passwords, leaving them unprotected and, as a result, massively infected. Few people know this, but a significant portion of DDoS attacks in recent years have been launched from IoT botnets.

Stressors: legal tester or weapon of a malicious actor

Stressors are online services that are officially positioned as tools for testing the resilience of websites to load. At first glance, this sounds legitimate: a company wants to make sure that its website can withstand peak traffic, so it turns to the service and conducts a control stress test. In theory, this makes sense and is of high quality.

However, practice shows that these services are easily and frequently used to carry out real attacks. Anyone can go to the website of such a service, enter the domain of a competitor or victim, pay a few dollars for a “test,” and launch a real DDoS attack. At the same time, the organizer of the attack remains anonymous, because the stressor uses proxies, masks IP addresses, and encrypts logs.

The real scenario looks like this: a small e-commerce store slows down and crashes. An investigation reveals that the site was attacked via a popular stresser service, but it is impossible to find out who ordered the attack. Suspicions fall on a competitor, but there is no evidence. Authorities in most countries are slow to respond to such claims, delving deeper and deeper into civil/criminal law. Meanwhile, the store has already lost profits and reputation.

Paid DDoS services

Another vector of attacks is organized cybercriminal groups that provide DDoS as a service. In the shadow segment of the internet (dark forums, private chats), you can find ads such as: “Attack on a website for $10–20 per hour.” For small, poorly protected resources, these are the prices. However, for large, well-protected services that filter traffic at the network level, the attack is more expensive—they can charge hundreds of dollars per day.

The organizers of such services do not necessarily manage botnets themselves. They often rent capacity, resell services to each other, forming complex chains that are difficult to investigate. Some groups combine their own botnets, rented VPS servers, stolen computing resources, and stressors into a single machine. The result is mega-scale attack power that can be activated in minutes.

Types and categories of DDoS attacks

DDoS attacks are highly diverse, and understanding their types is critical to choosing the right defense strategy. Traditionally, attacks are classified according to the OSI (Open Systems Interconnection) model, which describes how data is transmitted over computer networks. This classification is practical because each level of attack requires its own detection and neutralization methodology.

Attacks at the communication channel level

The most powerful DDoS attacks in terms of volume operate at the lowest levels of the network—at the communication channel level. The goal of such an attack is simple but effective: to overload the physical communication channel or network equipment (routers, switches, gateways) to such an extent that no traffic can pass through the channel.

UDP flood is one of the classic examples of such an attack. Powerful streams of UDP packets with fake addresses are sent from a botnet to your IP address. Each packet is small, but there are millions of them per second. The entire communication channel is filled with this “garbage,” and legitimate users simply cannot access your site.

ICMP flood, or “ping flood,” is an attack that sends a huge number of ICMP ECHO REQUEST (ping) packets. The server is forced to respond to each ECHO REPLY packet, which leads to the entire channel bandwidth being used up for “ping-pong” with the attacking machines.

Such attacks are often measured in gigabits or even terabits per second of traffic. Powerful attacks of this type are often directed not at small websites, but at large providers, data centers, cloud providers, and government agencies, because specific infrastructure and coordination are required to achieve an attack level of more than 10 Gbit/sec.

Protocol-level attacks (TCP)

Protocol-level attacks are slightly more sophisticated than channel floods. They exploit the characteristics of network protocols (TCP, UDP, ICMP) to exhaust the computing resources of servers and network equipment.

SYN flood is one of the most common attacks of this type. A TCP connection begins with a process called a three-way handshake. The client sends a SYN packet, the server responds with a SYN-ACK, then the client sends an ACK, and the connection is established. During a SYN flood, the attacker sends a powerful stream of SYN packets, but never completes the handshake—the second ACK packet never arrives. The server leaves all these half-open connections in a special queue, waiting for completion. When the queue overflows (and it quickly overflows during a SYN flood), the server stops accepting new connections from legitimate users.

Ping of Death is an attack that sends malformed or excessively large ICMP packets, causing errors in the operating system or network equipment of some devices. Although modern operating systems are well protected against this classic attack, older equipment or exotic devices are sometimes still vulnerable.

Application-level attacks

The most complex and dangerous DDoS attacks for businesses occur at the application level. At this level, the attack targets not the network infrastructure, but the web server itself, request processing, and database interaction.

HTTP flood, also known as Layer 7 DDoS or XFF (X-Forwarded-For) attack, sends a huge number of seemingly normal HTTP GET or POST requests. An HTTP request itself is a legitimate operation. But when an attacker launches thousands of such requests to resource-intensive pages (for example, search results, authorization forms, filtered product catalogs), the server is forced to access the database, perform complex calculations, and generate HTML for each request. Even 100–200 requests per second to such pages can “take down” a typical website on a popular CMS (WordPress, Drupal, Joomla).

Attacks on DNS servers represent another facet of L7 attacks. DNS translates human-readable names (e.g., example.com) into IP addresses. If an attacker can overload your DNS or convince upper-level DNS caches to return incorrect addresses, clients will be redirected to fake websites, infected servers, or simply nowhere.

The peculiarity of application-level attacks is that they are often very inconspicuous in terms of traffic volume. An attack may only be a few gigabits per second, which is relatively small, but if those gigabits consist of requests for expensive operations, they can completely destroy a website. This is what makes L7 attacks so insidious—they are difficult to distinguish from a legitimate surge in popularity until it is too late.

Who carries out DDoS attacks?

An analysis of the motivations behind DDoS attacks reveals a surprising diversity of causes and personalities. This is not a monolithic group of failed hackers, but a complex ecosystem where the causes, methods, and scale of attacks vary from ridiculous to catastrophic.

The first and most common perpetrator is unscrupulous competitors. When company B sees that company A is becoming more popular in the market and even taking away customers, there is a temptation to quickly take out the competitor. Instead of a long competitive struggle, where product quality and marketing are important, for a couple of dozen dollars on a stressor, you can “take down” a competitor’s website for several hours. The result is that the website is unavailable, customers cannot place orders, and they switch to the competitor (the organizer of the attack).

Blackmailers are the next category. The principle is simple: attack the website, make it inaccessible, then send a message to the owner demanding money to stop the attack or threatening to launch it. Given the low awareness of DDoS among small companies, some owners actually pay up. For blackmailers, this is quick income with virtually no risk, as IP addresses are masked and payments go through crypto mixers.

Politically motivated groups are the third category. In the era of hybrid conflicts and information wars, DDoS attacks are often used as a tool of pressure at the state level. Government agencies, media resources, and political parties are attacked. When a government agency’s website is unavailable, it signals failure and a loss of public confidence. In larger conflicts (such as Russia’s aggression against Ukraine in 2022–2025), DDoS attacks are one element of cyberwarfare, often coordinated with physical combat.

“Students” and novice hackers attack websites mostly out of curiosity: as entertainment, as an attempt to show off their skills, as proof to their peers. They run ready-made attack scripts on popular websites, often without even understanding the legal consequences of their actions.

Internet racketeers are organized crime in its most systematic form. The group selects promising small and medium-sized companies, attacks them, and then offers to “provide protection” from future attacks for a monthly fee. In essence, it is the mafia, just in an online version.

Finally, professional cybercriminal groups often combine DDoS attacks with other types of attacks. When a company is focused on fighting DDoS (all staff on call, all resources directed toward defense), it is the perfect time for hackers to coordinate a cyberattack on the system itself, steal data, and install spyware. DDoS often serves as a distraction, and the real attack begins in parallel.

Signs and signals of a DDoS attack

How can you detect early on that your website is suffering from a DDoS attack? This is a critically important question, because response time often determines the difference between minimal damage and disaster. Signs can be divided into technical ones, which are seen by the system administrator, and behavioral ones, which are noticed by the business and users.

Technical specifications

From an IT infrastructure perspective, DDoS signals appear as sudden anomalies. It is normal for a website to process 50–100 requests per second. If this figure jumps to 10, 50, or 100 thousand requests per second in a matter of minutes, and the traffic graph shows a sharp increase, it is most likely a DDoS attack.

The load on the processor and memory suddenly spikes. Normally, the site uses 20–40% of the CPU and half of the RAM. Suddenly, the CPU jumps to 99%, the memory overflows, and the free disk space drops sharply. At the same time, the business logic has not changed, and no large-scale operations have been launched.

Network interfaces are becoming saturated. Bandwidth monitoring shows that the communication channel is being used at 100% capacity, although previously it was only being utilized at 10%. Traffic is arriving in waves, in streams, and does not follow normal patterns.

A large number of requests from unusual IP addresses. Analysis of web server logs shows that most requests come from unknown IP addresses, often even from the same region, country, or even subnet. At first glance, this does not make sense, since it is normal for customers to be located around the world.

The requests are of the same type. All requests go to the same page, the same URL, with the same User-Agent (similar to a bot), without variations. This is another strong signal, because real users, even if inconspicuously, click on different pages, use different browsers, and come from different devices.

The web server freezes, the database does not respond. When attempting to connect to the server via SSH, the connection is established very slowly or not at all. The database returns errors about an overflowing connection queue. This indicates that all resources are exhausted.

Behavioral signals

Beyond technical metrics, signs of DDoS attacks are also noticeable at the business level. Users complain that the website loads very slowly. Previously, the page loaded in 2 seconds, but now we wait 30 seconds, and often the page does not load at all.

Customers cannot place orders, log in, or perform critical operations. Orders are frozen in the online store, waiting for a response from the server. Customers cannot transfer money in the banking system.

Sudden drop in conversion. Analytics show that traffic to the site has increased, but orders, registrations, and clicks on ads have dropped sharply. This indicates that people are coming to the site, but because it is down or very slow, they quickly leave.

Monitoring services such as “is the site down?” show unavailability. If you subscribe to services such as Uptime Robot, StatusCake, or others, they will record that your site has stopped responding to requests.

Social networks are filled with complaints. Customers, unaware of the technical details, simply write on Facebook, Twitter, Instagram: “Your website is not working! Where is my order?” In a matter of minutes, these complaints gain momentum and the impact on reputation grows.

Practical methods of protection against DDoS attacks

For most companies, a thorough understanding of what a secure website is goes far beyond simply installing HTTPS and regularly updating plugins. True security is a comprehensive information security system that encompasses infrastructure architecture, network security, monitoring, and incident preparedness. When all these components work together seamlessly, attacks are transformed from a disaster into a manageable risk.

Passive protection (prevention)

The highest level of security is based on the principle that preventing an attack is always better than dealing with the consequences. Passive protection is something that a company can put in place in advance to reduce the likelihood of a successful attack and maintain the ability to recover quickly, even if an attack does occur.

The first step is to choose high-quality hosting or data centers with sufficient bandwidth. If your typical traffic is 1 Gbit/sec, your hosting provider should provide you with a guaranteed bandwidth of at least 10 Gbit/sec so that you have room to maneuver in the event of an attack. Tier III+ data centers with 99.999% uptime (such as Atman data centers, officially represented by Hostpark) guarantee resistance to technical failures along with DDoS protection.

The second step is timely updates and patching. DDoS attacks are often combined with vulnerability attacks. Outdated software (OS, web server, CMS, libraries) contains known vulnerabilities that attackers can exploit. Regular updates close these loopholes.

Configuring basic network restrictions significantly strengthens protection. Restricting requests by country (geo-IP filtering) — if your business only operates in Europe, requests from South Korea or Tanzania can be automatically blocked. Rate limiting: if a single IP address sends more than 1,000 requests per second, that IP is automatically blocked for a certain period of time.

Using a CDN (Content Delivery Network) significantly distributes the load. Instead of all traffic being directed to your main server, a CDN has hundreds of servers around the world that cache and deliver content. In a DDoS attack, even if attackers bombard one CDN node, the rest of the resources remain untouched.

Monitoring and alerts are an important part of prevention. The system should not only collect metrics, but also generate notifications when values exceed normal limits. If the CPU suddenly rises to 80%, the administrator should immediately receive an SMS, email, or push notification.

Active protection (during an attack)

When prevention fails and an attack begins, it is important to have effective mechanisms for active response. Response time often determines whether the site is down for 15 minutes or three days.

The first step is to quickly identify the nature of the attack. Is it a large-scale channel attack (DDoS at the Gbit/sec level), a protocol attack (SYN flood), or a subtle application (HTTP flood)? Each type requires its own response.

Enabling blocking and filtering policies is the next step. If the attack is coming from a specific country, you can block all traffic from there. If the attack uses specific ports or protocols, you can remove these requests at the firewall level.

Special rules can be set at the web server level (nginx, Apache). For example, returning a special response (444 in nginx – closed without response) instead of the standard 403, which saves resources, since there is no need to generate an HTML error page. You can filter requests with the same User-Agent, which is often characteristic of attacking bots.

If necessary, temporarily switch to backup infrastructure. If the main server is overloaded, traffic can be redirected to backup machines, cloud services, or other data centers.

Technical solutions and AntiDDoS services

However, for truly powerful DDoS attacks, the skills and knowledge of your own administrator are often insufficient. Professional technical solutions based on data centers and international network infrastructure are required.

The concept behind this type of protection is simple but effective: traffic must be filtered and cleaned before malicious packets reach your server. This means that filtering takes place at the level of the telecommunications operator’s network infrastructure or data center, rather than at the level of your web server. Essentially, you get a huge “spread” of the attack—instead of your single server being attacked, the attack is spread across the data center’s infrastructure.

Hostpark’s AntiDDoS solution based on Red Guardian works exactly according to this model. The system installs hardware and software components (sensors and scrubbers) directly in Atman data centers. When signs of an anomaly appear (a sudden jump in traffic, atypical request patterns), the system automatically recognizes the attack and redirects the traffic of the target IP address to the scrubber for processing.

Traffic is filtered on the scrubber according to special rules and signatures. Malicious packets are removed, and cleaned legitimate traffic is returned to your infrastructure via the main channel. If necessary, if the attack is very powerful, the system can activate a “black hole” — complete isolation from the source of the attack, which guarantees 100% protection of the internal infrastructure, although in this case some legitimate traffic is also blocked (this is an extreme measure used only for security).

The key advantages of this approach for businesses are immediately apparent. First, protection against truly powerful DDoS attacks at the provider level, which exceed the bandwidth of a typical website by millions of times. Second, minimal response time and automatic detection without human intervention, which often delays the response. Third, seamless integration with other Hostpark services (Atman Cloud, Business Internet, dedicated servers), which means a single point of control and accountability to the customer.

According to the provider, it takes up to 7 business days to launch the service, with a dedicated team that builds a protection architecture specifically for your infrastructure and requirements.

How to prepare for a possible DDoS attack?

Even with the best protection, there is always a factor of uncertainty. Therefore, competent preparation for a possible attack is what significantly minimizes downtime and losses if the attack is successful.

Disaster recovery plan

Every company that depends on its IT infrastructure must have a written Disaster Recovery Plan. The plan describes the procedures and resources necessary to restore critical systems and data.

In the context of DDoS, the plan should include: identification of critical services (which functions are absolutely necessary and which can wait), priority of their restoration, available backup resources, DNS and traffic switching procedures, and contact details for all participants. The plan must be regularly reviewed and tested—it is not enough to simply write it down; it is important to make sure that it actually works in a real emergency.

This plan should be linked to your decisions based on Hostpark. If you have data centers in both Ukraine and the EU, the plan should take into account how quickly critical services can be switched to European infrastructure and ensure data synchronization.

Backup servers and systems

To avoid having to start recovery from scratch during an attack, a company must invest in backup infrastructure in advance. This could be a secondary server in another data center, even in another country, that is ready to accept traffic within minutes.

Data must be regularly replicated to backup sites. If the main database is located in Ukraine, backup copies must be constantly synchronized with the database in the EU. Thus, if the main server becomes unavailable, the backup copy will be 100% up to date or will lag by only a few seconds.

Cloud services (cloud instances, VPS) provide flexibility for rapid scaling. If necessary, you can launch additional servers in a matter of minutes and redirect traffic to them.

An example of the right strategy is the experience of Universal Bank, which, together with Hostpark, deployed a parallel data center in Europe, synchronized systems, and connected them with powerful data transmission channels. This architecture allows the bank to withstand not only DDoS attacks, but also geographical failures, local failures, and other disasters.

Team and communication

In conclusion, it should be emphasized that technical readiness is only half the battle. Organizational readiness is equally important.

The team must know their roles and responsibilities. When an attack begins, there is no time to discuss who does what. The administrator knows that he applies the filtering criteria; DevOps activates backup servers; PR prepares messages for customers; management informs strategic counterparties and partners about the situation.

Prescribed scenarios and checklists help avoid impulsive mistakes under stress. “In case of a DDoS attack: (1) Check metrics; (2) Activate filters; (3) Switch to backup infrastructure; (4) Notify Hostpark…” Such checklists save effort and minimize response time.

Домовленості з хостинг-провайдером повинні бути чіткі: яким чином ескалюються інциденти, хто є точкою контакту, який гарантований час відгуку. Провайдер рівня Hostpark повинен мати 24/7 техпідтримку і чітке SLA (Service Level Agreement) по годинам реакції.

Conclusion

A DDoS attack is not a rare espionage operation carried out by specialized hackers, as is often portrayed in movies. It is one of the most common and accessible cyberattack tools in the digital world. It can be ordered for a few dollars, launched in a matter of minutes, but its cost to a business can be calculated in thousands or millions. Lost orders, angry customers, ruined reputation—these are all consequences of a successful DDoS attack.

However, contrary to widespread pessimism, DDoS attacks are a manageable risk. They are not inevitable or invisible if you prepare for them in advance. The right infrastructure architecture, robust encryption and security, professional monitoring, and contingency plans can make your business resilient to most attacks.

To make your website truly secure, it is not enough to simply update your CMS, install a captcha, and hope for the best. You need a comprehensive infrastructure built on reliable data centers with high availability, direct communication channels (ping from 13 ms to European infrastructure), and specialized AntiDDoS protection.

Hostpark combines all the necessary components. It has its own infrastructure in Poland and Ukraine, a partnership with Atman, one of the most modern data centers in Europe, and extensive experience in building fault-tolerant solutions for clients such as Universal Bank and other large companies. The Red Guardian AntiDDoS service provides multi-level protection against attacks of any complexity: from huge volume floods to sophisticated Layer 7 applications.

If a stable online presence is not just a desire but a critical factor for the success of your business, then DDoS should not be viewed as “something that happens” but as a manageable risk that needs to be addressed at the infrastructure level. It is an investment in peace of mind, in the confidence that your website will be available when it matters most. In a world where competition can be settled by an attack and an hour of downtime costs millions, that confidence is worth the money.