Avernar Best we could figure that was when too many people were trying to load the site once it was off. They had the site set up with an nginx proxy web server running on the public IP address. That had a DDOS plugin in it as well as things like caching the favico etc. At some point someone turned off the "backend" server that the proxy server talked to - it could have been running on the same iron or it could have been on a different machine (my guess) - that had the database server, http service, messaging services for email notifications, etc. Once that got turned off but they left nginx running, every single time someone tries to load the site they hit the proxy server. It's running and waiting for you, but it can't get the "goods" to serve back, and it takes something like 110 seconds for it to give up and time out. If 50 people are trying to load the site at once and they all are sitting in that 110 second "hold" eventually they fill up the DDOS protection algorithm and it fires off and gives up the DDOS protection error 502 instead of the normal nginx timeout error (I notice if I try to load it late at night or early in the AM I never get the DDOS screen, but between lunchtime and 9PM I often get it).
