content: This is all I could really glean:   Getting back online required the technical assistance of several services, including networking experts from IP-Max, service provider Level 3 Communications, and Radware, a DDoS-mitigation service. Even now, the attacks are continuing, but they're no longer capable of knocking ProtonMail offline for long periods of time.   ...  If there are DDoS experts interested in reviewing the attack data, we welcome them to contact us at security@protonmail.ch  Additionally the comments on the article itself pose the same question you have with some attempts to answer:   The answer is terse, very terse but in there. Too terse TBH since you need to know a bit of the technology to see that. Get help from Level 3 to identify legitimate traffic to their upstream provider. Block the rest at Level 3. Make use of a DDoS mitigation company. This would help their provider (IP-Max) and the people that it serves by effectively redirecting any traffic to ProtonMail away from said provider and to the servers of a company that are specifically setup to handle the flood. Radware in this case runs multiple data centers (the cloud in marketing speak) relying on, among other mitigation techniques, anycast to reduce the size of the flood.  It sounds like ProtonMail is being more tight-lipped about the details, which is probably understandable from a security perspective.