Its almost impossible to upgrade your server to the point where they can withstand a DDOS attack; unless they are Apple, Google, or Microsoft.
The problem with the milestones is that many people use multiple accounts and use VPNs and have like probably 50-100 different alts, and right before the winning number they basically bet like crazy trying to strike the winning number. Then they just disappear and won't gamble again. While the honest gamblers don't reap the rewards they deserve.
Hence this is the reason why you need to set a really high bet base limit or just limit the amount of bets per second during that period where the milestone will be hit.
Most likely it won't get done because its way too much programming work for such a simple milestone contest, hence they just leave it as is.
Have you read this news? https://www.wired.com/story/github-ddos-memcached/
It's the biggest ddos in history, they don't use cloudflare, yeah? So how did they solve it? With servers and great system maybe, that's just my opinion.
I read the article and yes its fairly impressive.
Github though has probably more knowledge and many connections like they did with Akamai to get the issue resolved.
The way they re-routed the traffic was smart and I am wondering why sites don't just implement something similiar but will need some way of finding out which traffic is legit and which isn't.
Its pretty crazy that sites are still getting attacked the same way as back in the 90s. I would of assumed there would have been better protection for these types of attacks by now.