Hi,

We use a variety of methods internally, and with our partners. One thing we do is use providers that are able to blackhole, or cordon off traffic from an IP range, or to a certain server. We also have internal teams that constantly monitor and react to events like the ones that you bring up. We also have the ability to move server and DNS traffic around on our own infrastructure, and can dynamically add resources to a pool of servers to handle traffic spikes.