Method and system for handling computer network attacks

A computer-implemented method for handling denial of service (DOS) attacks, comprising:

• storing, at a domain name service (DNS) server of a particular point of presence (POP) of a plurality of POPs, information about another POP of said plurality of POPs;
• wherein each of the plurality of POPs comprises one or more content servers;
• determining whether a capacity threshold has been exceeded for the particular POP, said determination including determining whether a capacity threshold has been exceeded for at least one content server in the particular POP;
• while the capacity threshold is exceeded for the particular POP:
• receiving a DNS request from a DNS server in the particular POP;
• if the information does not indicate an attack affecting the other POP, redirecting, based on the data, the DNS request to a DNS server in the other POP;
• if the information indicates an attack affecting the other POP, determining to not redirect the DNS request to a DNS server in the other POP.

One or more non-transitory computer-readable storage media storing instructions for handling attacks, wherein execution of the instructions by one or more processors causes:

• storing, at a domain name service (DNS) server of a particular point of presence (POP) of a plurality of POPs, information about another POP of said plurality of POPs;
• wherein each of the plurality of POPs comprises one or more content servers;
• determining whether a capacity threshold has been exceeded for the particular POP, said determination including determining whether a capacity threshold has been exceeded for at least one content server in the particular POP;
• while the capacity threshold is exceeded for the particular POP:
• receiving a DNS request from a DNS server in the particular POP;
• if the information does not indicate an attack affecting the other POP, redirecting, based on the data, the DNS request to a DNS server in the other POP;
• if the information indicates an attack affecting the other POP, determining to not redirect the DNS request to a DNS server in the other POP.

A system for handling attacks, comprising:

• one or more computers with one or more processors and memory storing instructions which, when executed by the one or more processors, cause the one or more computers to perform steps that include:
• storing, at a domain name service (DNS) server of a particular point of presence (POP) of a plurality of POPs, information about another POP of said plurality of POPs;
• wherein each of the plurality of POPs comprises one or more content servers;
• determining whether a capacity threshold has been exceeded for the particular POP, said determination including determining whether a capacity threshold has been exceeded for at least one content server in the particular POP;
• while the capacity threshold is exceeded for the particular POP:
• receiving a DNS request from a DNS server in the particular POP;
• if the information does not indicate an attack affecting the other POP, redirecting, based on the data, the DNS request to a DNS server in the other POP;
• if the information indicates an attack affecting the other POP, determining to not redirect the DNS request to a DNS server in the other POP.