I Built a Real-Time DDoS Detection Engine from Scratch - Here's Every Decision I Made

No Fail2Ban. No rate-limiting libraries. No shortcuts. Just Python, a deque, and statistics. There is a moment every engineer dreads. You are staring at your monitoring dashboard. The request graph is vertical. Your server is on its knees. Legitimate users are getting timeouts. And somewhere out there, an attacker is running a script they downloaded in five minutes - while your defence took you zero minutes to build, because you had none. That was the situation at cloud.ng , a rapidly growing cl