The DDoS that wasn’t: a key takeaway for web domain security