A DDoS (Distributed Denial of Service) attack occurs when multiple systems, often part of a botnet, send excessive traffic or requests to a targeted server or service.
Unlike traditional DoS attacks, which originate from a single source, DDoS attacks are distributed, making them harder to detect and mitigate.
A successful DDoS attack can cause significant performance issues or even complete downtime on its targets.
This often causes reputational damage, as customers are less likely to trust a service exposed to cyber threats and significant financial losses.
In some cases, DDoS attacks can be used to attract the attention of the security team and divert attention from a larger breach occurring elsewhere within the target’s systems.
In this article, we will explore what DDoS attacks are and how we protect your websites from them.
DDoS Attack Simplified
Prior to launching a DDoS attack, the attacker will usually send out malware in the form of phishing scams or illicit links. Anyone unlucky enough to fall for the scam will have their computer infected with malware and the attacker will have full, remote control.
This malware is typically dormant, and most users will not know their computer is infected until the attack starts. Machines infected with this kind of malware are typically known as zombies, bots or collectively, a botnet.
Once the attacker has infected enough machines, they will initiate the attack.
The attacker will issue an instruction to all ‘zombies’ to simultaneously flood the target with as many requests as they can.
If the requests are enough to exhaust the victim server’s resources, the server will be rendered useless, and legitimate users will not be able to use its services.
The 3 Main Types of DDoS Attacks
DDoS attacks are typically classified into three categories based on their target.
1. Volumetric Attacks
The goal of a volumetric attack is to saturate the target’s bandwidth with massive amounts of traffic.
How It Works:
- Attackers flood the target with data packets using UDP, ICMP, or spoofed TCP packets.
- The traffic volume is measured in gigabytes per second or packets per second.
- These attacks aim to consume all available network bandwidth, effectively limiting legitimate traffic.
Common Techniques:
- UDP Flood – Sends a large number of UDP packets to random ports, causing the host to respond with ICMP “Destination Unreachable” packets.
- ICMP Flood – Overloads the network with ICMP Echo Request (ping) packets.
- Amplification Attacks – Uses publicly available servers like DNS (Domain Name System) or NTP (Network Time Protocol) to send amplified responses to the victim.
Example:
A DNS amplification attack sends a query from a spoofed IP address (the victim’s IP) to a DNS server. The server responds with a much larger reply to the victim, overwhelming them.
2. Protocol Attacks (Network-Layer Attacks)
The goal of network-layer attacks is to exploit weaknesses in Layer 3 and Layer 4 of the OSI model (network and transport layers) to consume server resources or infrastructure components like firewalls and load balancers.
A common network layer attack is known as a SYN flood, and it is achieved by exploiting a flaw in the TCP handshake. For two machines to effectively communicate, they will need to establish a TCP connection, which consists of a three-way handshake as depicted in the image below:
How It Works:
- These attacks use malformed protocol requests to exhaust system resources.
- They often bypass standard rate-limiting defences.
Common Techniques:
- SYN Flood – Sends a stream of TCP connection requests (SYN) but never completes the handshake, causing the server to allocate resources for half-open connections.
- ACK Flood – Overwhelms systems by sending large amounts of TCP ACK packets.
Example:
In a SYN flood, the attacker sends thousands of TCP SYN packets from all available machines without completing the connection (3-way handshake), exhausting the server’s memory.
3. Application Layer Attacks (Layer 7 Attacks)
Layer 7 attacks aim to exhaust server resources by mimicking legitimate user behaviour at the application layer. HTTP is a common protocol for these attacks and entails users sending an HTTP GET request to a web server to request access to a website.
How It Works:
- These attacks target web servers, APIs, or applications, often with HTTP requests that appear normal.
- Since these requests consume more resources per connection, even a low volume of traffic can cause downtime.
Common Techniques:
- HTTP Flood – Repeatedly requests web pages or APIs, overloading backend processes or databases.
- Slowloris – Opens connections to the server and slowly sends incomplete HTTP requests, keeping connections open and tying up resources.
- DNS Query Floods – Overwhelm DNS servers with excessive, legitimate-looking queries.
Example:
A botnet floods an e-commerce site with HTTP GET requests for product pages, simulating real traffic. The server attempts to serve all pages, quickly consuming CPU and memory, which can bring the server down for legitimate users.
How we protect you from DDoS attacks
At 20i, we have an extensive suite of enterprise-level security and performance boosting platform features that help to protect your websites and our infrastructure for malicious attacks like DDoS.
As a reseller, this is something that you can advertise as your own and provide to your customers for free to distinguish yourself from mediocre hosting providers.
CDN
Our Content Delivery Network (CDN) helps to prevent DDoS attacks by distributing and absorbing malicious traffic across a network of globally distributed servers.
Traffic Distribution – Our CDN uses multiple edge servers located around the world. When a DDoS attack floods a website with traffic, the CDN can disperse that load across many servers, reducing the strain on the origin server.
Rate Limiting and Filtering – Our CDN identifies and throttles suspicious traffic using rate limiting and CAPTCHA to block suspicious traffic. We filter traffic based on IP reputation, geolocation, request patterns, or known bad actors.
Caching Content – Since a CDN caches static content like images, scripts, and videos, many requests don’t even reach the origin servers, keeping it safe and minimising exposure to volumetric attacks by default
Always-On DDoS Protection – Our CDN offers integrated DDoS protection as part of the service and is designed to automatically detect and mitigate attacks in real-time.
StackProtect
Our proprietary security system, StackProtect, employs Google’s reCAPTCHA to challenge and verify suspicious requests, effectively blocking automated bots attempting to access login pages or exploit vulnerabilities.
Bot and Brute-Force Attack Mitigation – StackProtect effectively blocks automated bots attempting to access login pages or exploit vulnerabilities. Once a visitor successfully completes the CAPTCHA, their IP address is whitelisted across all 20i-hosted sites for 48 hours, reducing repeated challenges for legitimate users.
DDoS Protection – The system monitors and mitigates Layer 7 HTTP flood attacks by identifying and filtering out malicious traffic. This helps maintain website availability even during high-volume attack attempts.
Suspicious IP Monitoring – StackProtect tracks IP addresses known for fraudulent or malicious activities and stores these in a database. Requests from these IPs are typically blocked outright to prevent potential threats.
Integration with our WAF – Working alongside StackProtect, our WAF provides an additional layer of security by inspecting incoming traffic for threats like SQL injections and cross-site scripting XSS attacks, blocking them before they reach your website.
WAF
Our Web Application Firewall (WAF) helps to prevent DDoS attacks by monitoring, filtering, and blocking malicious HTTP traffic before it reaches your web server. This is especially effective against application layer (layer 7) attacks.
Inspecting Layer 7 Requests – our WAF examines incoming HTTP requests for patterns typical of DDoS attacks, like repeated access to resource-heavy endpoints, excessive form submissions or login attempts, and requests from known bad bots or IPs, which lets the WAF block or challenge malicious traffic targeting your site.
Behavioural and Rate-Based Rules – our WAF can detect abnormal usage patterns such as an abnormally large number of requests originating from a single IP or user. It can throttle, block, or CAPTCHA such requests based on rate-limiting policies, protecting your websites from being overwhelmed.
Challenge Mechanisms – Our WAF deploys JavaScript challenges or CAPTCHA to determine if a client is human, which stops basic bots and slows down more advanced attack tools.
Integration with Load Balancers and CDN – our WAF is used alongside load balancers and our CDN to form a multi-layered DDoS mitigation strategy. The WAF handles complex, application-specific threats while the others absorb or redirect bulk traffic.
Load Balancers
Our load balancers are reverse proxy servers, spreading incoming requests across a multitude of backend servers. During a DDoS attack, this helps ensure that no single server gets overwhelmed. This is especially effective against volumetric attacks that aim to exhaust server resources.
Traffic Filtering and Throttling – our load balancers can detect unusual request patterns, rate-limit connections from abusive IPs, and block malformed or obviously malicious requests. This is seamlessly integrated with our WAFs and threat intelligence feeds for smarter filtering.
Redundancy and Failover – load balancers enable redundant infrastructure, so even in the unlikely event one server is taken offline by an attack, others immediately take over.
Behavioural Analysis – our load balancers include real-time analytics and anomaly detection to identify and respond to DDoS activity early before services degrade.
Integration with CDN and WAF – our load balancers are used in conjunction with our CDN and WAF to provide a layered defence that stops both infrastructure and application-layer attacks.
Conclusion
DDoS attacks remain one of the most effective and disruptive cyberattack methods. Understanding the three types volumetric, protocol, and application-layer, is essential for developing a robust defence strategy.
At 20i, we believe that you shouldn’t have to pay for website security, so we include DDoS protection, WAF, and brute force protection among many other security features absolutely free on our Reseller and Managed services.
On our robust platform, with intensive monitoring, layered defences, and scalable infrastructure, we easily mitigate the impact and keep services resilient in the event of such attacks.