A while back I was called by one of my friends. He is a Sys Admin at a company that offers products on-line in the Danish health sector. He was under DDOS attack from multiple countries and had a hard time to follow up on blocking the IP-ranges, which were hitting him from southern America.

A way to prevent these attack to impact on you website, is in my opinion to know your users. The websites he manage is strictly for Danish consumers, and a guy hitting the site from Japan or Germany has no interest in the site – But then some foreign countries has, if their USER-AGENT contains some words like “Google”, “BING” etc.

A DDOS attack is typically spread all over the globe, which can be tricky to block at the edge level, while the attack is going.

I have very good experience in dividing webclusters up on “good” and “bad” clusters. Good clusters are for the known users and the “bad” ones are for the “bad” users.

MaxMind offers a GeoLocation services out from a public ip address. Giving you the option, to take the larger IP ranges from a Country (ex Denmark) and divert them to the Good cluster. The bad cluster should serve all the others IP’s – If a DDOS is going on, it will only hit the “Bad” cluster, making your user Impact relatively small.

This was actually what saved my friend, after 4 hours of DDOS attack. Danish consumers could shop as they normal would, while the attack was hitting the bad cluster.

After being with Just-Eat for about 14 months I have decided to go new ways. A lot have happend throughtout the months, and with the feeling that my job has been done. Its time for me to say goodbye to all my fellow collegues in 8 countries and my beloved staff.  You will all be missed.

What plans are ahead, are my little secret for now