DDoS – whose responsibility is it?