Here is a photo of the rack https://i.imgur.com/wMFG1.jpg. We do not have a full rack to ourselves yet.
3 mac mins (top) - 4 servers in one chassis (middle) - firewall & intrusion detection (bottom).
They are not really ddos attacks which a company like that would be able to help with. It is more just a few dozen tor ip addresses causing problems. For example one ip opening 1000's of websocket connections, or generating huge numbers of forwarding addresses.
It is entirely in ram. The site averages about 200-300 queries / second which isn't anything particularly special but cpu usage of ndb averages about 20%, considering this is decent 4 server cluster I feel like the load should be lower. However I haven't benchmarked it against any other database so I don't know if it really is an ndb problem or poor schema/query design. On the plus side it's pretty stable, I think before the recent maintenance it ran for 100 consecutive days without problems. In future I imagine moving to something like HBase/Cassandra but not for a while yet.