Patent ID: 8612564

Claim:
A computer-implemented method for handling attacks, comprising: at a domain name service (DNS) server, receiving a first request to resolve a hostname from a client; with the DNS server, sending a first set of one or more IP addresses to the client in response to the first request, the first set of IP addresses being associated with one or more web servers; determining that at least one IP address in the first set of IP addresses is under attack; at the DNS server, and after the determination that the at least one IP address in the first set of IP addresses is under attack, receiving a second request to resolve the hostname from the same or another client; with the DNS server, sending a second set of one or more IP addresses to the client that made the second request, the second set of IP addresses including at least one IP address that is different than any of the one or more IP addresses in the first set of IP addresses; wherein the second set is sent rather than the first set as a result of the determination that the at least one IP address in the first set of IP addresses is under attack.