A method for mitigating attacks against a distributed computing system, the distributed computing system providing a service from a plurality of service endpoints addressable over one or more computer networks and a request routing mechanism that directs clients to one or more servers in the plurality of servers, the method comprising: extracting from the request routing mechanism a mapping of one or more clients to one or more service endpoints; sending the mapping to at least one enforcement point in the distributed computing system on a network path between the client and the one or more service endpoints; subsequent to said receipt of the mapping, receiving a network packet sent from a particular client to the one or more service endpoints; based on one or more characteristics of the network packet, checking whether the packet is consistent with the mapping from the request routing mechanism, and based at least in part on said check: (i) if the particular client is mapped to the one or more service endpoints, passing the network packet; (ii) if the particular client is not mapped to the one or more service endpoints, taking a mitigation action, the mitigation action selected from the group of actions that is: blocking the network packet; logging the network packet for further inspection; generating an alert about the packet; sending information about the client and the inconsistency to a client reputation scoring system; characterized in that the method further comprises the request routing mechanism, in response to an in-progress attack, initiating a change in the mapping as a challenge to client devices to consult the request routing mechanism and follow the mapping changes. extracting from the request routing mechanism a mapping of one or more clients to one or more service endpoints; sending the mapping to at least one enforcement point in the distributed computing system on a network path between the client and the one or more service endpoints; subsequent to said receipt of the mapping, receiving a network packet sent from a particular client to the one or more service endpoints; based on one or more characteristics of the network packet, checking whether the packet is consistent with the mapping from the request routing mechanism, and based at least in part on said check: (i) if the particular client is mapped to the one or more service endpoints, passing the network packet; (ii) if the particular client is not mapped to the one or more service endpoints, taking a mitigation action, the mitigation action selected from the group of actions that is: blocking the network packet; logging the network packet for further inspection; generating an alert about the packet; sending information about the client and the inconsistency to a client reputation scoring system; (i) if the particular client is mapped to the one or more service endpoints, passing the network packet; (ii) if the particular client is not mapped to the one or more service endpoints, taking a mitigation action, the mitigation action selected from the group of actions that is: blocking the network packet; logging the network packet for further inspection; generating an alert about the packet; sending information about the client and the inconsistency to a client reputation scoring system; blocking the network packet; logging the network packet for further inspection; generating an alert about the packet; sending information about the client and the inconsistency to a client reputation scoring system; characterized in that the method further comprises the request routing mechanism, in response to an in-progress attack, initiating a change in the mapping as a challenge to client devices to consult the request routing mechanism and follow the mapping changes.