Rackspace DDOS Mitigation Addendum

Rackspace DDOS Mitigation Addendum

In addition to the other terms of the Agreement, your use of the Rackspace DDOS Mitigation Service is subject to the following terms and conditions:

1. Rackspace DDOS Mitigation Service. Once we have received your order for the Rackspace DDOS Mitigation Service, we will evaluate your hosted system and website(s). Your hosted system must meet our minimum configuration and engineering requirements to purchase Rackspace’s DDOS Mitigation Service, and we may cancel your order and refund your money if we discover that these requirements are not met.

Once we have completed our qualification process, we will begin monitoring your covered IP addresses to establish a baseline traffic profile for your website(s) (the “Learning Phase”). At the end of the Learning Phase, we will be ready to activate your Rackspace DDOS Mitigation Service using the custom profile(s) we have developed. Some changes to your normal website traffic or configuration such as the addition of a new web service or a large new customer may impact the effectiveness of the Rackspace DDOS Mitigation Service, you must notify us if such changes occur so that we may place the profile back into the Learning Phase.

We will activate your Rackspace DDOS Mitigation Service on your request if you are under an attack. If we detect an attack ourselves, we will activate the Rackspace DDOS Mitigation Subscription Service and notify you.

2. Rackspace DDOS Mitigation Subscription. If you purchase the Subscription feature of the Rackspace DDOS Mitigation Service, we will engage in an extended Learning Phase which we expect to take between three and seven days, but the number of days may be extended if there are traffic anomalies during the Learning Phase.

3. Rackspace DDOS Mitigation On-Demand. The Rackspace DDOS Mitigation On-Demand Services rely on a standard mitigation profile, rather than one we have developed based on an extended Learning Phase. Within three (3) hours of the time that you complete our ordering process for Rackspace DDOS Mitigation On-Demand, we will activate the service for your covered website(s) for up to 30 days from activation or until the attack subsides. We will continue working with you to develop this profile for up to 8 hours from activation of the DDOS Mitigation Services.

4. Changes to Website Address. You must notify us if you wish to change the IP addresses that are being monitored by the Rackspace DDOS Mitigation Service.

5. Insufficient Mitigation.

5.1 We will notify you if we detect an attack which we believe the Rackspace DDOS Mitigation Service is unable to satisfactorily mitigate based on existing profiles and service capacity, or which we believe may result in unusually high bandwidth charges. We will confer with you regarding measures that may be available, if any, to avoid escalating to a Warning or Critical status as described below.

5.2 Warning. In the event that your bandwidth usage meets or exceeds 50% of the capacity of any one of our Internet Service Providers, or the attack begins to approach the Rackspace DDOS Mitigation Service capacity, we will promptly notify your designated technical representative to warn of impending escalation procedures, such as null routing, upstream blocking, or suspension of service. We will confer with you regarding measures that may be available, if any, to avoid further escalation.

5.3 Critical. In the event that your bandwidth usage meets or exceeds 80% of the capacity of any one of our Internet Service Providers, or the attack exceeds the Rackspace DDOS Mitigation Service capacity, we may null route your traffic or take other measures as necessary to protect our network and other customers without notice to you, but will notify you promptly of the steps taken and confer with you regarding measures available, if any, to mitigate the attack or de-escalate its severity level as described in this Section 5.

6. Disclaimer. You acknowledge that the Rackspace DDOS Mitigation Service may not successfully mitigate all attacks, and may also result in some legitimate traffic being diverted from your website(s). We reserve the right to escalate to a Warning or Critical status as we deem necessary in our sole discretion to protect our network and other customers. We may refuse or discontinue the Rackspace DDOS Mitigation Service at any time by giving reasonable advance notice if we determine, in our sole discretion, that the website(s) and/or domains for which you have requested the service pose an undue risk to our network or other customers. Otherwise, the Rackspace DDOS Mitigation Service is provided subject to the terms and conditions of the Agreement and these terms.

RACKSPACE MAKES NO WARRANTY OR GUARANTY WHATSOEVER REGARDING THE RACKSPACE DDOS MITIGATION SERVICE, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, DISCLAIMS ANY AND ALL WARRANTIES INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.