Patent ID: 8204976

Claim:
A computer-implemented method for handling attacks, comprising: storing, at a domain name service (DNS) server in a particular point of presence (POP) of a plurality of POPs, information about another POP of said plurality of POPs; wherein each of the plurality of POPs comprises one or more content servers; determining whether a capacity threshold has been exceeded for the particular POP, said determination including determining whether a capacity threshold has been exceeded for at least one content server in the particular POP; while the capacity threshold is exceeded for the particular POP: receiving a DNS request at the DNS server in the particular POP; if the information does not indicate an attack affecting the other POP, redirecting, based on the data, the DNS request to a DNS server in the other POP; if the information indicates an attack affecting the other POP, determining to not redirect the DNS request to a DNS server in the other POP.