When your business is under attack, the most terrifying outcome is not the attack itself — it is your protection provider cutting your IP off entirely. That practice is called blackholing, and it is far more common than the marketing copy admits.
The irony: technically it is called "protection," but in outcome terms, the attacker has won without doing any extra work. They did not breach you; your own provider did the takedown for them.
How blackholing works
Blackholing (also called null routing, or RTBH — Remote Triggered Black Hole — in BGP terms) is brutally simple:
When traffic to an IP exceeds a preset threshold, the ISP or cloud provider injects a route that drops all traffic destined for that IP — attack and legitimate alike — at the edge router.
- ✅ The attack traffic is indeed stopped
- ❌ Legitimate user traffic is dropped along with it — every customer, every region, every request
- ❌ Your business goes completely offline until the attack ends
From the provider's perspective, this is "good neighbor" hygiene: it protects the rest of their network (and other paying tenants) from your attack traffic. From your perspective, it means your provider unilaterally terminated your service at the worst possible moment. The route can persist for the entire attack window — minutes to hours — and in some misconfigured setups, lingers far longer than the attack.
Why providers do it
Understand the three motives and you can judge whether a provider is trustworthy:
1. Cost control
Scrubbing attack traffic costs real money — scrubbing appliances, transit bandwidth, and compute. On a shared pool, your attack consumes capacity that other customers paid for. Blackholing is the cheapest possible response: one routing command, near-zero cost. For a provider already losing margin on your account, it is the path of least resistance.
2. Business model incentives
This is the critical one. If a provider bills by scrubbed traffic volume, its revenue scales with your attack size — but scrubbing a multi-hundred-Gbps attack has high marginal cost, so the overage may actually lose them money. "Blackhole past a certain point" then becomes commercially rational, because honoring the attack costs more than dropping you.
Conversely: only a provider on a fixed-fee model has its incentives properly aligned. No matter how hard you are hit, their revenue is unchanged and their costs are manageable — so the optimal move is to actually stop the attack, not hand the attacker a win. This is why pricing structure, not marketing, predicts behavior under fire.
3. Liability avoidance
Some providers write "attacks above a certain scale are not covered" into their terms of service. That clause is the escape hatch that lets them legally blackhole you at will, with no breach-of-contract claim available to you.
The real cost of blackholing
Let's make it concrete. Suppose you run an e-commerce business doing $2,000 per hour in online sales. Your plan cap is 500 Gbps of scrubbing, and an attacker sends a 600 Gbps UDP flood — deliberately "just over" your threshold, knowing exactly what it will trigger:
| Dimension | Consequence of blackholing |
|---|---|
| Outage | You are down as long as the attack lasts (potentially hours) |
| Revenue | Online sales drop to zero for the entire duration — $2,000/hour gone, plus the attack is cheap to keep running |
| Customer loss | Users will not wait — they buy from a competitor, and often never return |
| Brand damage | "It was down when I needed it" is nearly impossible to undo |
| SEO impact | Prolonged unavailability makes search engines rate your site lower for weeks |
| Attacker wins | Extortionists see you cave easily and escalate their demands next time |
Attackers count on this. They know your plan cap, so a campaign sized "just above your threshold" is enough to take you offline — and it costs them almost nothing. The blackhole is the whole attack; the flood is just the trigger.
The recovery trap most teams forget
Even after the attack stops, blackholing leaves a hangover. Two traps bite teams that think "it's over, we're back":
- Route propagation lag. The blackhole route can take time to withdraw and re-propagate across the internet. Your monitoring may show "attack ended," but a slice of users worldwide is still being dropped for minutes to hours afterward.
- DNS and CDN cache poisoning of the outage. During the blackout, resolvers and downstream caches mark your endpoints unhealthy and may keep serving failures or stale states even after the route recovers — so your apparent uptime lags reality by a TTL cycle or two.
The only real fix is to never be blackholed in the first place.
Our position: never blackhole
AwayDDoS operates on an iron rule: no blackholing and no surge pricing during an attack.
Concretely:
- Massive scrubbing capacity — the combined capacity of our global nodes absorbs Tbps-scale floods (including NTP ~556x and Memcached ~50,000x amplification) with no hard per-customer cap, so a 600 Gbps attack is just a Tuesday.
- Two-layer cleaning architecture — near-source scrubbing dilutes the peak first, then deep cleaning filters precisely, so capacity and appliances are spent where they matter rather than bluntly dropping everything.
- Fixed pricing — costs do not scale with attack volume, which aligns our interests completely with your uptime.
- 7×24 expert operations — our security team intervenes and tunes policies during an attack instead of just dropping a blocklist and walking away.
For you, the practical experience is simple: when an attack happens, your users never even know it happened. No outage, no recovery lag, no "we were down" post-mortem.
How to spot a blackhole clause during procurement
Ask these four questions and watch how they answer:
- [ ] "What happens if attack traffic exceeds my plan — am I blackholed?"
- [ ] "Will pricing increase or require an upgrade during an attack?"
- [ ] "Does your terms of service exclude 'attacks above a certain scale'?"
- [ ] "Will you commit in writing to no blackholing during an attack?"
Vague answers on the second and third questions are a strong signal that blackholing risk exists — and that the vendor's incentives diverge from your uptime the moment a real attack lands.
Key takeaways
Blackholing is a sign of failed protection, not a protection method. A "defense" that shuts your business down is essentially finishing the attacker's job for them — and leaving you with a recovery hangover on top.
When evaluating providers, always confirm how they handle extreme attacks. It tells you more than any bandwidth figure ever will.
AwayDDoS commits to zero blackholing during attacks. To explore our full protection architecture and fixed-fee model, get in touch — or read How to Choose a DDoS Protection Provider: 5 Key Metrics.