INFRASTRUCTURE DESIGN DOCUMENT

High-Availability Manga Platform Architecture


⚠️ DISCLAIMER

This document is a thought experiment and educational material only.

This infrastructure design is:

  • Theoretical and unverified
  • For educational purposes - To understand distributed systems, CDN architecture, and resilience patterns
  • Not legal advice
  • Not an endorsement - Of copyright infringement or illegal activities

The techniques described explore concepts in:

  • Distributed systems architecture
  • Geographic redundancy
  • CDN optimization
  • Security hardening
  • Disaster recovery planning

EXECUTIVE SUMMARY

The system uses multiple domains, distributed servers, object storage (MinIO), and CDN delivery to create a platform that's fast, scalable, and resistant to takedowns.

Key Metrics:

  • Storage Capacity: 30TB (10,000 manga titles)
  • Expected Traffic: 1-10M visits/month
  • Takedown Resistance: High (multi-domain, multi-IP)
  • Geographic Distribution: 3+ countries
  • CDN Providers: 3-5 (depending on tier)

PART 1: CORE ARCHITECTURE

1. SYSTEM OVERVIEW DIAGRAM

                    ┌─────────────────────────────────────────┐
                             GLOBAL USERS                    
                        (Accessing from anywhere)            
                    └──────────────────┬──────────────────────┘
                                       
                    ┌─────────────────────────────────────────┐
                          MULTIPLE DOMAINS                   
                      mangasite.ws  (Primary - Active)       
                      mangasite.sh  (Backup - Ready)         
                      mangasite.to  (Backup - Ready)         
                      123manga.com  (Backup - Ready)         
                      mangasite.ru  (Backup - Ready)         
                      + 10 more backup domains               
                    └──────────────────┬──────────────────────┘
                                       
                    ┌─────────────────────────────────────────┐
                          CLOUDFLARE (Free)                  
                      - DNS Management                       
                      - DDoS Protection                      
                      - SSL/TLS Certificates                 
                    └──────────────────┬──────────────────────┘
                    ┌─────────────────────────────────────────┐
                          GeoDNS / Load Balancer             
                      Routes traffic based on location       
                    └──────────────────┬──────────────────────┘
                                       
        ┌──────────────────────────────┼──────────────────────────────┐
                                                                    
┌───────────────────┐        ┌───────────────────┐        ┌───────────────────┐
   SERVER 1                   SERVER 2                   SERVER 3        
   RUSSIA                     MOLDOVA                    ICELAND         
   IP: 5.6.7.8                IP: 91.92.93.94            IP: 82.221.x.x  
                                                                         
 ┌───────────────┐          ┌───────────────┐          ┌───────────────┐ 
  FRONTEND                 FRONTEND                 FRONTEND       
  (Next.js)                (Next.js)                (Next.js)      
 └───────────────┘          └───────────────┘          └───────────────┘ 
                                                                         
 ┌───────────────┐          ┌───────────────┐          ┌───────────────┐ 
  PostgreSQL               PostgreSQL               PostgreSQL     
  (Metadata DB)            (Replica)                (Replica)      
 └───────────────┘          └───────────────┘          └───────────────┘ 
                                                                         
 ┌───────────────┐          ┌───────────────┐          ┌───────────────┐ 
  MinIO                    MinIO                    MinIO          
  10TB Storage             10TB Storage             10TB Storage   
  (Manga A-F)              (Manga G-M)              (Manga N-Z)    
 └───────┬───────┘          └───────┬───────┘          └───────┬───────┘ 
└─────────┼─────────┘        └─────────┼─────────┘        └─────────┼─────────┘
                                                                  
          └────────────────────────────┼────────────────────────────┘
                                
                    ┌─────────────────────────────────────────┐
                             BUNNYCDN                        
                      Global CDN - Pull Zone                 
                      - Pulls images from MinIO              
                      - Caches globally for 30 days          
                      - 85+ PoPs worldwide                   
                    └─────────────────────────────────────────┘

2. MULTI-DOMAIN STRATEGY

2.1 Domain Portfolio Structure

┌──────────────────────────────────────────────────────────────┐
│ DOMAIN HIERARCHY │
└──────────────────────────────────────────────────────────────┘

TIER 1: ACTIVE DOMAIN (Currently In Use)
┌─────────────────────────────────────────────────────────────┐
mangasite.ws
│ Status: ACTIVE ✓ │
│ DNS: Cloudflare │
│ SSL: Let's Encrypt (Auto-renew) │
│ Indexed: Google, Bing │
│ Traffic: 100% of users │
└─────────────────────────────────────────────────────────────┘

TIER 2: HOT STANDBY (Ready to Activate Immediately)
┌─────────────────────────────────────────────────────────────┐
mangasite.sh - DNS configured, SSL ready │
mangasite.to - DNS configured, SSL ready │
123manga.com - DNS configured, SSL ready │
mangasite.io - DNS configured, SSL ready │
│ │
│ Can activate in: 1-2 hours │
│ Cost: ~$15/year each │
└─────────────────────────────────────────────────────────────┘

TIER 3: COLD BACKUP (Registered, Parked)
┌─────────────────────────────────────────────────────────────┐
mangasite.ru - Registered, no DNS yet │
mangasite.net - Registered, no DNS yet │
mangaav.com - Registered, no DNS yet │
readmanga.to - Registered, no DNS yet │
│ + 6 more variations │
│ │
│ Can activate in: 4-8 hours │
│ Cost: ~$10/year each │
└─────────────────────────────────────────────────────────────┘

TOTAL INVESTMENT: $200-300/year for all domains

2.2 Domain Seizure Response Plan

TIMELINE: What Happens When Primary Domain Gets Seized

Hour 0: 🚨 SEIZURE DETECTED
├─ mangasite.ws suddenly redirects to seizure notice
├─ Monitoring alerts trigger
└─ Emergency response begins

Hour 1: ACTIVATE BACKUP DOMAIN
├─ Update DNS: mangasite.sh becomes new primary
├─ SSL certificate already configured (instant)
├─ Internal links updated automatically
└─ Backend detects domain change, updates URLs

Hour 2: COMMUNICATION BLITZ
├─ Post on X/Twitter: "New domain: mangasite.sh"
├─ Reddit announcement in relevant subs
├─ Discord/Telegram notifications
├─ Update bookmarks on aggregator sites
└─ Email notification to registered users (if any)

Hour 4-24: USER MIGRATION
├─ Most users find new domain via Google/social
├─ Old users bookmark new domain
├─ Traffic recovers to 80% of normal
└─ Search engines begin indexing new domain

Week 1: STABILIZATION
├─ 95% traffic recovered
├─ New domain fully indexed
├─ mangasite.ws = dead (abandoned)
└─ Next backup domain prepared

RESULT: 4-8 hours downtime maximum
Service continuity maintained
Minimal user loss

2.3 TLD Selection Strategy

RECOMMENDED DOMAIN PORTFOLIO:

Primary (User Trust):
┌──────────────────────────────────┐
│ .ws - Good SEO, hard to seize │
│ .to - Island nation, lenient
│ .io - Tech-friendly │
└──────────────────────────────────┘
Note: .to domains may respond to US pressure (money-driven)

Backup (Seizure Resistant):
┌──────────────────────────────────┐
│ .ru - Russia (ignores US law) │
│ .sh - St. Helena (remote) │
│ .md - Moldova (lenient) │
└──────────────────────────────────┘

Avoid (Easy to Seize):
┌──────────────────────────────────┐
│ .com - US jurisdiction │
│ .net - US jurisdiction │
│ .org - US jurisdiction │
└──────────────────────────────────┘

USE STRATEGY: Start with .ws or .to
Keep .com as decoy
Backups in .ru, .sh, .md

3. SERVER DISTRIBUTION

3.1 Geographic Distribution Map

GLOBAL SERVER PLACEMENT

    ICELAND                    RUSSIA              
  Server 3                   Server 1           
                                                
[Europe Users]            [Asia Users]            
                                                
Fast: 50ms                Fast: 40ms              
                                                
Handles 30%               Handles 40%             
of traffic                of traffic              

          MOLDOVA                                 
          Server 2                               
                                                 
      [EU + US Users]                             
                                                 
       Fast: 60ms                                 
                                                 
       Handles 30%                                
       of traffic                                 

WHY THIS DISTRIBUTION:

  • Russia: Close to Asia (largest manga market)
  • Moldova: Central Europe (good for EU + US East)
  • Iceland: Good for US West + Europe
  • All offshore = DMCA resistance

3.2 Server Specifications

PER-SERVER CONFIGURATION

┌─────────────────────────────────────────────────┐
│ VPS SPECS (Each Server) │
├─────────────────────────────────────────────────┤
│ RAM: 8GB │
│ CPU: 4 cores │
│ Storage: 500GB SSD (OS + Database) │
│ Additional: 10TB HDD (MinIO storage) │
│ Bandwidth: Unmetered @ 1Gbps │
│ IP: 1 dedicated IPv4 │
│ Location: Russia/Moldova/Iceland │
│ Cost: $40-80/month each │
└─────────────────────────────────────────────────┘

SOFTWARE STACK (Each Server)
┌─────────────────────────────────────────────────┐
│ Docker: Container orchestration │
│ MinIO: Object storage (S3-compatible) │
│ PostgreSQL: Manga metadata database │
│ Redis: Caching layer │
│ Next.js: Frontend application │
│ Nginx: Reverse proxy │
└─────────────────────────────────────────────────┘

STORAGE ALLOCATION PER SERVER
┌─────────────────────────────────────────────────┐
│ Manga titles: 3,333 titles │
│ Average size: 3GB per title │
│ Total storage: ~10TB │
│ Compression: WebP format │
│ Retention: Permanent (no deletion) │
└─────────────────────────────────────────────────┘

3.3 Load Distribution Logic

HOW TRAFFIC IS ROUTED

METHOD 1: GEOGRAPHIC ROUTING (Recommended)
┌──────────────────────────────────────────────┐
│ │
│ User connects from: Tokyo, Japan │
│ ↓ │
│ GeoDNS detects: Asia region │
│ ↓ │
│ Returns IP: 5.6.7.8 (Russia server) │
│ ↓ │
│ User connects to nearest server │
│ Latency: 40ms (fast!) │
│ │
└──────────────────────────────────────────────┘

METHOD 2: ROUND ROBIN (Backup)
┌──────────────────────────────────────────────┐
│ │
│ Request 1 → Server 1 (Russia) │
│ Request 2 → Server 2 (Moldova) │
│ Request 3 → Server 3 (Iceland) │
│ Request 4 → Server 1 (Russia) │
│ ...cycles through all servers │
│ │
└──────────────────────────────────────────────┘

METHOD 3: HASH-BASED (For Specific Manga)
┌──────────────────────────────────────────────┐
│ │
│ Manga ID: "one-piece" │
│ ↓ │
│ Hash: hash("one-piece") % 3 = 1 │
│ ↓ │
│ Route to: Server 2 (Moldova) │
│ ↓ │
│ Always routes same manga to same server │
│ Consistent for caching │
│ │
└──────────────────────────────────────────────┘

4. STORAGE ARCHITECTURE (MinIO)

4.1 MinIO Deployment Model

STORAGE HIERARCHY

┌────────────────────────────────────────────────────────────┐
│                    MINIO CLUSTER                           │
│                (Distributed Across 3 Servers)              │
└────────────────────────────────────────────────────────────┘
        ┌────────────────────┼────────────────────┐
        ↓                    ↓                    ↓
┌───────────────┐    ┌───────────────┐    ┌───────────────┐
│   MinIO #1    │    │   MinIO #2    │    │   MinIO #3    │
│   Russia      │    │   Moldova     │    │   Iceland     │
├───────────────┤    ├───────────────┤    ├───────────────┤
│ Bucket:       │    │ Bucket:       │    │ Bucket:       │
│ manga-bucket  │    │ manga-bucket  │    │ manga-bucket  │
│               │    │               │    │               │
│ Contains:     │    │ Contains:     │    │ Contains:     │
│ Manga A-F     │    │ Manga G-M     │    │ Manga N-Z     │
│ (3,333 titles)│    │ (3,333 titles)│    │ (3,334 titles)│
│               │    │               │    │               │
│ Size: 10TB    │    │ Size: 10TB    │    │ Size: 10TB    │
└───────────────┘    └───────────────┘    └───────────────┘

BENEFITS:
✓ No single point of failure
✓ Distributed storage load
✓ Geographic redundancy
✓ Each server fully independent

4.2 Bucket Structure

DETAILED FOLDER ORGANIZATION

manga-bucket/

├── titles/                           Main manga content
   
   ├── one-piece/
      ├── cover.webp               (50 KB - thumbnail)
      ├── metadata.json            (2 KB - info)
      
      ├── chapter-001/
         ├── p001.webp            (200 KB)
         ├── p002.webp            (200 KB)
         ├── ...
         └── p020.webp            (200 KB)
         └── Total: 4 MB
      
      ├── chapter-002/
         └── (20 pages, 4 MB)
      
      └── ... (1000 chapters = 4 GB total)
   
   ├── naruto/
      ├── cover.webp
      ├── chapter-001/
      └── ... (700 chapters = 2.8 GB)
   
   └── ... (10,000 titles = 30 TB total)

├── thumbnails/                       Quick-load covers
   ├── one-piece.webp               (50 KB)
   ├── naruto.webp                  (50 KB)
   └── ... (10,000 × 50KB = 500 MB)

└── optimized/                        Multi-resolution
    └── titles/
        └── one-piece/
            └── chapter-001/
                ├── p001-1200w.webp  (200 KB - desktop)
                ├── p001-800w.webp   (100 KB - tablet)
                └── p001-480w.webp   (50 KB - mobile)

4.3 Image Optimization Pipeline

UPLOAD PROCESS FLOW

┌──────────────────────────────────────────────────────────┐
1. ORIGINAL FILESource: raw-scan.pngSize: 5 MB (2400×3600 px)└──────────────────────┬───────────────────────────────────┘
┌──────────────────────────────────────────────────────────┐
2. PREPROCESSING- Remove watermarks (if any)- Crop margins- Adjust brightness/contrast- Straighten if needed└──────────────────────┬───────────────────────────────────┘
┌──────────────────────────────────────────────────────────┐
3. RESIZEDesktop:  1200px width (maintains aspect ratio)Tablet:   800px widthMobile:   480px width└──────────────────────┬───────────────────────────────────┘
┌──────────────────────────────────────────────────────────┐
4. CONVERT TO WEBPQuality: 85% (sweet spot)Result: 200 KB (desktop)Compression: 96% size reduction!└──────────────────────┬───────────────────────────────────┘
┌──────────────────────────────────────────────────────────┐
5. UPLOAD TO MINIOPath: titles/one-piece/chapter-001/p001.webpMetadata:                                            │
- Content-Type: image/webp- Cache-Control: public, max-age=2592000- Width: 1200px- Height: 1800px└──────────────────────┬───────────────────────────────────┘
┌──────────────────────────────────────────────────────────┐
6. UPDATE DATABASEPostgreSQL record:                                   │
- chapter_id: uuid- page_number: 1- file_path: titles/one-piece/chapter-001/p001.webp- width: 1200- height: 1800- file_size: 204800 (bytes)└──────────────────────────────────────────────────────────┘

5. CDN LAYER (BunnyCDN)

5.1 BunnyCDN Pull Zone Configuration

BUNNYCDN SETUP

┌────────────────────────────────────────────────────────┐
│ PULL ZONE CONFIGURATION │
├────────────────────────────────────────────────────────┤
│ Name: MangaSite-Images │
│ Type: Pull Zone (not push) │
│ Origin URL: https://minio.mangasite.ws:9000
│ Custom Domain: cdn.mangasite.ws
│ │
│ CACHING │
│ ├─ Cache Expiry: 30 days (2592000 seconds) │
│ ├─ Browser Cache: 7 days │
│ ├─ Query String: Ignore (consistent caching) │
│ └─ Strip Cookies: Yes │
│ │
│ OPTIMIZATION │
│ ├─ WebP Optimization: Already optimized (skip) │
│ ├─ Compression: Brotli + Gzip │
│ ├─ Minification: N/A (images only) │
│ └─ HTTP/2: Enabled │
│ │
│ SECURITY │
│ ├─ SSL/TLS: Let's Encrypt (auto) │
│ ├─ Token Auth: Disabled (public content) │
│ ├─ Geo-Blocking: None │
│ └─ Hotlink Protect: Optional (your domains only) │
│ │
│ REGIONS (Enable All) │
│ ├─ Europe: $0.01/GB │
│ ├─ North America: $0.01/GB │
│ ├─ Asia/Oceania: $0.03/GB │
│ ├─ South America: $0.045/GB │
│ └─ Africa: $0.045/GB │
└────────────────────────────────────────────────────────┘

DNS CONFIGURATION:
cdn.mangasite.ws → CNAME → mangasite-images.b-cdn.net

5.2 Pull Zone Workflow

HOW PULL ZONE WORKS (First Request)

┌──────────────────────────────────────────────────────────┐
USER REQUEST #1 (Cache MISS)└──────────────────────────────────────────────────────────┘
    User browser requests:
    https://cdn.mangasite.ws/titles/one-piece/chapter-001/p001.webp
                    ┌────────────────┐
BunnyCDNEdge Server(London)                    └────────┬───────┘
            Checks cache: MISS (not cached yet)
                    ┌────────────────┐
BunnyCDNMakes PullRequest                    └────────┬───────┘
                             Connects to origin:
    https://minio.mangasite.ws:9000/manga-bucket/titles/...
                    ┌────────────────┐
MinIORussia VPSReturns file                    └────────┬───────┘
                    p001.webp (200 KB)
                    ┌────────────────┐
BunnyCDNCaches filefor 30 days                    └────────┬───────┘
                    Returns to user
                    (Total time: ~500ms)


┌──────────────────────────────────────────────────────────┐
USER REQUEST #2 (Cache HIT)└──────────────────────────────────────────────────────────┘
                             Another user requests same image:
    https://cdn.mangasite.ws/titles/one-piece/chapter-001/p001.webp
                    ┌────────────────┐
BunnyCDNEdge Server(Tokyo)                    └────────┬───────┘
            Checks cache: HIT! (already cached)
                    Returns from cache immediately
                    (Total time: ~20ms)
                    No origin request needed!

CACHE HIT RATE:

  • First week: 60-70% (building cache)
  • After month: 95%+ (most images cached)
  • Result: 95% of requests never hit origin server

5.3 Cost Calculation

BANDWIDTH COST BREAKDOWN

SCENARIO: 1 Million Chapter Reads/Month

Per Chapter:
├─ 20 pages
├─ 200 KB per page (WebP)
└─ 4 MB per chapter

Total Traffic:
├─ 1M chapters × 4 MB = 4 TB
└─ + Overhead (thumbnails, metadata) = 5 TB total

BunnyCDN Cost:
├─ 5 TB @ $0.01/GB (US/EU) = $50
├─ Or mix: 3 TB US/EU + 2 TB Asia
│ └─ (3TB × $0.01) + (2TB × $0.03) = $90
└─ Total: $50-90/month


PART 2: SECURITY & PRIVACY

6. GEO-BLOCKING STRATEGY

Should you block Japan/Korea IPs?

YES - Strongly Recommended

BLOCK THESE COUNTRIES:
┌────────────────────────────────────────────┐
│ 🇯🇵 Japan - Publishers based here │
│ 🇰🇷 Korea - Webtoon companies here │
│ 🇺🇸 USA - DMCA lawsuits originate │
│ - (Optional - huge traffic) │
└────────────────────────────────────────────┘

WHY BLOCK JAPAN/KOREA:
┌────────────────────────────────────────────┐
│ Publishers monitor from these IPs │
│ Legal teams gather evidence │
│ Delays detection by 6-12 months │
│ Makes takedown notices harder │
└────────────────────────────────────────────┘

IMPLEMENTATION:
┌────────────────────────────────────────────┐
│ Method 1: Cloudflare Firewall Rules │
│ (Free tier - block by country) │
│ │
│ Method 2: Nginx GeoIP blocking │
│ (Server-level) │
│ │
│ Method 3: BunnyCDN geo-restrictions │
│ (CDN-level blocking) │
└────────────────────────────────────────────┘

VPN Detection

PROBLEM:
Japanese publisher uses VPN → appears as US IP → gets access

DETECTION METHODS:

  1. VPN IP Database
    ├─ Services: IPQualityScore, MaxMind
    ├─ Cost: $50-200/month
    └─ Block known VPN/datacenter IPs
  2. Behavioral Analysis
    ├─ Real users: erratic browsing
    ├─ Publishers: systematic scanning
    └─ Block suspicious patterns
  3. CAPTCHA for New IPs
    ├─ First visit from new IP → CAPTCHA
    ├─ Publishers script scrapers (fail CAPTCHA)
    └─ Real users solve it once

VPN DETECTION TECHNIQUES

Basic Method: IP Geolocation

1
2
3
4
User IP: 104.28.5.6
Lookup: MaxMind GeoIP2
Result: "United States, Cloudflare"
Type: Datacenter IP ← Suspicious!

Advanced Method: IP Intelligence API

Service: IPQualityScore, IPHub
Input: 104.28.5.6
Output:
{
  "proxy": true,
  "vpn": true,
  "type": "VPN",
  "provider": "NordVPN",
  "risk_score": 95
}

Behavioral Method:
├─ Real user: Browses multiple manga
├─ VPN + Publisher: Systematic scanning
│ └─ Checks 100 titles in 10 minutes
└─ Block pattern: Too fast = bot/scraper

7. ANONYMITY & PRIVACY

7.1 BunnyCDN Registration - How Anonymous Can You Be?

BUNNYCDN REGISTRATION REQUIREMENTS

WHAT THEY COLLECT:
┌────────────────────────────────────────────┐
│ Email address ← REQUIRED │
│ Payment method ← REQUIRED │
│ IP address (signup) ← AUTO-COLLECTED │
│ Name/Address ← OPTIONAL (for CC) │
└────────────────────────────────────────────┘

THEY STORE:
┌────────────────────────────────────────────┐
│ Your account details │
│ Origin server IPs (where they pull from) │
│ Traffic logs (30 days) │
│ Payment history │
└────────────────────────────────────────────┘

LEGAL EXPOSURE:
┌────────────────────────────────────────────┐
│ Publishers can subpoena BunnyCDN │
│ BunnyCDN will reveal: │
│ ├─ Email address used │
│ ├─ Payment method │
│ ├─ Origin server IPs │
│ └─ Traffic stats │
│ │
│ This leads them to YOUR servers │
└────────────────────────────────────────────┘

7.2 How to Maximize Anonymity

ANONYMITY STRATEGY FOR BUNNYCDN

  1. BURNER EMAIL
    ├─ Use: ProtonMail, Tutanota
    ├─ Accessed via VPN only
    └─ Never linked to real identity
  2. CRYPTOCURRENCY PAYMENT
    ├─ BunnyCDN accepts Bitcoin
    ├─ Use privacy coin mixer
    ├─ Create new wallet for each payment
    └─ Never KYC exchange
  3. REGISTER THROUGH VPN
    ├─ Use: Mullvad, IVPN (no logs)
    ├─ Never your home IP
    └─ Different VPN each login
  4. ORIGIN SERVER MASKING
    ├─ Don't point BunnyCDN directly to your VPS
    ├─ Use intermediary proxy/load balancer
    └─ BunnyCDN sees proxy, not origin
  5. PRIVACY-FOCUSED CDN ALTERNATIVES
    ├─ BunnyCDN - Good, accepts crypto
    ├─ KeyCDN - Similar, less KYC
    └─ Self-hosted CDN - Most private but complex

7.3 What BunnyCDN Cannot See

WHAT BUNNYCDN DOESN'T KNOW

✓ Content of files (encrypted in transit)
✓ Your actual location (if using VPN)
✓ Your real identity (if using burner email + crypto)
✓ Your origin server (if using proxy layer)

✗ BUT they can see:
├─ Origin IP you configured (unless proxied)
├─ Domain names (cdn.yoursite.ws)
└─ Traffic patterns

SUBPOENA SCENARIO

Good Opsec:

Publisher sues  Court orders BunnyCDN records
        
BunnyCDN provides:
├─ Email: throwaway@protonmail.com (dead end)
├─ Payment: Bitcoin wallet (hard to trace)
├─ Origin IP: 5.6.7.8 (your Russia VPS)
        
Publisher subpoenas Russian VPS provider
        
Russian provider: "Не знаю" (ignores request)
        
Dead end for publisher 

VS

Bad Opsec:

1
2
3
4
5
├─ Email: yourname@gmail.com (real identity)
├─ Payment: Credit card (real name)
├─ Origin IP: Your home ISP
        
Publisher finds you immediately 

8. ORIGIN IP MASKING

Can you mask origin IP from BunnyCDN?

YES - Using Proxy Layer

ORIGIN IP MASKING ARCHITECTURE

WITHOUT PROXY (Bad):

1
2
3
4
BunnyCDNDirectly to your VPS (5.6.7.8)
         Publishers can subpoena BunnyCDN
         Get your VPS IP directly

WITH PROXY (Good):

1
2
3
4
5
6
7
BunnyCDN → Nginx Proxy (1.2.3.4)
         Proxy → Your actual VPS (5.6.7.8)
         Publishers subpoena BunnyCDN
         Only get proxy IP (1.2.3.4)
         Proxy is bulletproof host (ignores subpoenas)

9. ROUTING & IP TRACING DEFENSE

Can Publishers Find Origin IP?

TRACING METHODS

Method 1: DNS Lookup

1
2
3
cdn.yoursite.wsCNAMEbunnycdn.net
Dead end (CDN, not origin)

Method 2: HTTP Headers

1
2
3
4
5
Request to CDN returns:
X-Cache: HIT
Server: BunnyCDN
No origin IP exposed ✓

Method 3: SSL Certificate

1
2
3
4
Certificate issued to: cdn.yoursite.ws
Issued by: Let's Encrypt via BunnyCDN
No origin server info ✓

Method 4: Direct Origin Access

1
2
3
4
5
Try common ports:
https://yoursite.ws:9000 (MinIO)
If firewall blocks all except CDN IPSafeIf misconfiguredOrigin exposed

Method 5: Historical DNS Records

1
2
3
4
Check DNS history sites:
├─ securitytrails.com
├─ dnsdumpster.com
└─ Can reveal old A records if not careful

10. FIREWALL CONFIGURATION

CRITICAL: Firewall Configuration

FIREWALL RULES (iptables)

ONLY ALLOW BUNNYCDN IPs:

# Block all incoming traffic by default
iptables -P INPUT DROP

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (only from your IP)
iptables -A INPUT -p tcp --dport 22 -s YOUR_HOME_IP -j ACCEPT

# Allow ONLY BunnyCDN IP ranges to access MinIO
iptables -A INPUT -p tcp --dport 9000 -s 185.93.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -s 91.234.92.0/24 -j ACCEPT
# ... (add all BunnyCDN IP ranges)

# Drop everything else
iptables -A INPUT -j DROP

RESULT:

  • Only BunnyCDN can access your origin
  • Direct access attempts fail
  • Publishers can't bypass CDN

PART 3: ADVANCED FEATURES

11. MULTI-CDN ARCHITECTURE

11.1 The Strategy

SINGLE CDN (Basic - What most sites do):
┌─────────────────────────────────────────────┐
│ All traffic → BunnyCDN only │
│ │
│ RISK: BunnyCDN gets DMCA → entire site slow │
└─────────────────────────────────────────────┘

MULTI-CDN (Advanced - What MissAV does):
┌─────────────────────────────────────────────┐
│ Traffic distributed across: │
│ ├─ 40% → BunnyCDN │
│ ├─ 30% → Cloudflare │
│ ├─ 20% → Custom edge servers │
│ └─ 10% → KeyCDN (backup) │
│ │
│ BENEFIT: One gets DMCA → traffic shifts │
│ No single point of failure │
└─────────────────────────────────────────────┘

11.2 Multi-CDN Implementation

Architecture Diagram

                ┌──────────────────┐
                │   USER REQUEST   │
                │  cdn.site.ws     │
                └────────┬─────────┘
                ┌──────────────────┐
                │  CLOUDFLARE DNS  │
                │  (Smart Routing) │
                └────────┬─────────┘
          ┌──────────────┴──────────────┐
          ↓                             ↓
┌─────────────────┐           ┌─────────────────┐
│  40% of traffic │           │  30% of traffic │
│  ↓              │           │  ↓              │
│  cdn1.site.ws   │           │  cdn2.site.ws   │
│  (BunnyCDN)     │           │  (Cloudflare)   │
└────────┬────────┘           └────────┬────────┘
         ↓                             ↓
         └─────────────┬───────────────┘
          ┌────────────────────────┐
          │  20% → Custom Servers  │
          │  cdn3.site.ws          │
          │  (Your own edge nodes) │
          └────────────────────────┘
          ALL PULL FROM SAME ORIGIN
                ┌──────────────┐
                │ MinIO Origin │
                │ (Russia VPS) │
                └──────────────┘

11.3 Setup Multiple CDN Providers

PROVIDER SETUP

Provider 1: BunnyCDN
┌─────────────────────────────────────────────┐
│ Pull Zone: manga-bunny │
│ Origin: https://origin.site.internal:9000 │
│ Custom Domain: cdn1.mangasite.ws
│ Cost: $0.01/GB │
│ Purpose: Primary image delivery │
└─────────────────────────────────────────────┘

Provider 2: Cloudflare (Pro Plan)
┌─────────────────────────────────────────────┐
│ Domain: cdn2.mangasite.ws
│ Origin: https://origin.site.internal:9000 │
│ Page Rules: Cache Everything │
│ Cost: $20/month + bandwidth │
│ Purpose: DDoS protection + caching │
└─────────────────────────────────────────────┘

Provider 3: KeyCDN (Backup)
┌─────────────────────────────────────────────┐
│ Pull Zone: manga-key │
│ Origin: https://origin.site.internal:9000 │
│ Custom Domain: cdn3.mangasite.ws
│ Cost: $0.04/GB (more expensive) │
│ Purpose: Failover when others down │
└─────────────────────────────────────────────┘

Provider 4: Custom Edge Servers (DIY CDN)
┌─────────────────────────────────────────────┐
│ VPS 1: Tokyo (cdn-asia.site.ws) │
│ VPS 2: London (cdn-eu.site.ws) │
│ VPS 3: New York (cdn-us.site.ws) │
│ Cost: $15/month × 3 = $45/month │
│ Purpose: Full control, DMCA-resistant │
└─────────────────────────────────────────────┘

12. DNS-BASED LOAD BALANCING

Method A: Cloudflare Load Balancing

CLOUDFLARE DASHBOARD SETUP

Traffic → Load Balancer → Distributes to CDNs

Load Balancer Configuration:
┌─────────────────────────────────────────────┐
│ Hostname: cdn.mangasite.ws
│ │
│ Origin Pools: │
│ │
│ Pool 1: BunnyCDN (Weight: 40) │
│ └─ cdn1.mangasite.ws
│ │
│ Pool 2: Cloudflare R2 (Weight: 30) │
│ └─ cdn2.mangasite.ws
│ │
│ Pool 3: KeyCDN (Weight: 20) │
│ └─ cdn3.mangasite.ws
│ │
│ Pool 4: Custom Servers (Weight: 10) │
│ └─ cdn-asia.site.ws (Asia users) │
│ └─ cdn-eu.site.ws (EU users) │
│ └─ cdn-us.site.ws (US users) │
│ │
│ Health Checks: Every 30 seconds │
│ Failover: Automatic if pool down │
└─────────────────────────────────────────────┘

DNS Response Example:

1
2
3
4
5
6
7
User in Asia requests cdn.mangasite.ws
Cloudflare returns: cdn1.mangasite.ws (BunnyCDN)

User in Europe requests cdn.mangasite.ws
Cloudflare returns: cdn2.mangasite.ws (Cloudflare R2)

COST: $5/month (Cloudflare Load Balancer)

Method B: GeoDNS with NS1 or Route53

GEOGRAPHIC ROUTING

NS1 Configuration:
┌─────────────────────────────────────────────┐
│ Record: cdn.mangasite.ws
│ │
│ Asia Traffic (JP, KR, CN, etc.): │
│ └─ cdn-asia.site.ws (Tokyo VPS) │
│ │
│ Europe Traffic (UK, DE, FR, etc.): │
│ └─ cdn-eu.site.ws (London VPS) │
│ │
│ Americas (US, CA, MX, BR, etc.): │
│ └─ cdn-us.site.ws (NYC VPS) │
│ │
│ Fallback (Rest of World): │
│ └─ cdn1.mangasite.ws (BunnyCDN) │
└─────────────────────────────────────────────┘

COST: $8-30/month (NS1 or Route53)

13. CUSTOM DOMAIN MASKING

Why Masking Matters

WITHOUT MASKING:

1
2
3
4
User sees URL: https://mangasite.b-cdn.net/image.webp
                Publishers see "b-cdn.net" = BunnyCDN
                Easy to identify and target

WITH MASKING:

1
2
3
4
User sees URL: https://cdn.mangasite.ws/image.webp
                Custom domain - CDN provider hidden
                Harder to identify backend

Setup Custom Domains per CDN

DNS CONFIGURATION

BunnyCDN:
┌─────────────────────────────────────────────┐
cdn1.mangasite.ws CNAME mangasite.b-cdn.net
│ │
│ User sees: cdn1.mangasite.ws
│ Behind: BunnyCDN infrastructure │
└─────────────────────────────────────────────┘

Cloudflare:
┌─────────────────────────────────────────────┐
cdn2.mangasite.ws A 104.21.x.x (CF IP) │
│ │
│ User sees: cdn2.mangasite.ws
│ Behind: Cloudflare R2 + CDN │
└─────────────────────────────────────────────┘

KeyCDN:
┌─────────────────────────────────────────────┐
cdn3.mangasite.ws CNAME mangasite.kxcdn.com
│ │
│ User sees: cdn3.mangasite.ws
│ Behind: KeyCDN infrastructure │
└─────────────────────────────────────────────┘

Custom Servers:
┌─────────────────────────────────────────────┐
cdn-asia.site.ws A 45.76.x.x (Tokyo VPS) │
cdn-eu.site.ws A 91.92.x.x (London) │
cdn-us.site.ws A 23.94.x.x (NYC) │
│ │
│ User sees: Your custom domains │
│ Behind: Your VPS servers │
└─────────────────────────────────────────────┘

RESULT:
All URLs look like "your" domain
CDN providers hidden from casual inspection

14. MULTIPLE PROXY LAYERS

The Onion Architecture

LAYERED PROXY APPROACH

Layer 1: Public-Facing CDNs
┌─────────────────────────────────────────────┐
cdn1.mangasite.ws (BunnyCDN) │
cdn2.mangasite.ws (Cloudflare) │
└──────────────┬──────────────────────────────┘
↓ pulls from
Layer 2: Proxy Tier (Shields Origin)
┌─────────────────────────────────────────────┐
│ proxy1.internal (Russia) │
│ proxy2.internal (Moldova) │
└──────────────┬──────────────────────────────┘
↓ forwards to
Layer 3: Origin Servers (Hidden)
┌─────────────────────────────────────────────┐
│ origin1.internal (MinIO storage) │
│ origin2.internal (MinIO replica) │
└─────────────────────────────────────────────┘

BENEFIT:

  • CDN providers only know proxy IPs
  • Proxy layer in bulletproof hosting
  • Origin servers completely hidden
  • Can rotate proxies without changing CDNs

15. ROTATING INFRASTRUCTURE

Weekly Rotation Schedule

ROTATION STRATEGY

Week 1-4: Configuration A
┌─────────────────────────────────────────────┐
│ Primary: BunnyCDN (cdn1.site.ws) │
│ Secondary: Cloudflare (cdn2.site.ws) │
│ Backup: KeyCDN (cdn3.site.ws) │
│ Proxy: proxy1.ru (Russia) │
└─────────────────────────────────────────────┘

Week 5: ROTATION EVENT
├─ Deploy new proxy: proxy2.md (Moldova)
├─ Update CDN origins to point to proxy2
├─ DNS TTL set to 300 seconds (5 min)
└─ Gradual traffic shift over 24 hours

Week 5-8: Configuration B
┌─────────────────────────────────────────────┐
│ Primary: Cloudflare (cdn2.site.ws) │
│ Secondary: KeyCDN (cdn3.site.ws) │
│ Backup: BunnyCDN (cdn1.site.ws) │
│ Proxy: proxy2.md (Moldova) │
└─────────────────────────────────────────────┘

Week 9: ROTATION EVENT
├─ Retire proxy1, deploy proxy3
├─ Shift primary to KeyCDN
└─ Continue rotation...

BENEFITS:

  • Publishers can't pin down infrastructure
  • DMCA notices target old config (already changed)
  • Continuous service with no downtime

16. OBSCURATION TECHNIQUES

Technique 1: Random URL Patterns

// Instead of predictable URLs:
// BAD: /titles/one-piece/chapter-001/p001.webp

// Use hashed/encoded paths:
// GOOD: /c/a7f3d9e2/8h4k2p1m/q9w7e5r3.webp

function obfuscateImagePath(mangaId, chapterId, pageNum) {
  const hash1 = md5(`${mangaId}-${SECRET_SALT}`).substring(0, 8);
  const hash2 = md5(`${chapterId}-${SECRET_SALT}`).substring(0, 8);
  const hash3 = md5(`${pageNum}-${SECRET_SALT}`).substring(0, 8);

  return `/c/${hash1}/${hash2}/${hash3}.webp`;
}

// Database stores mapping:
// hash -> actual file location
// Publishers can't easily scrape all manga

Technique 2: Time-Limited Signed URLs

// Generate temporary URLs that expire

function generateSignedUrl(filePath, expiresIn = 3600) {
  const expires = Math.floor(Date.now() / 1000) + expiresIn;
  const signature = hmac_sha256(`${filePath}${expires}`, SECRET_KEY);

  return `${CDN_URL}${filePath}?expires=${expires}&sig=${signature}`;
}

// URL only valid for 1 hour
// Scrapers can't cache/redistribute URLs
// Example: /image.webp?expires=1735689600&sig=a3f2d9e1...

Technique 3: Domain Fronting (Advanced)

DOMAIN FRONTING TECHNIQUE

Use major CDNs' infrastructure to hide real destination:

User requests:
cdn.mangasite.ws
Resolves to:
Cloudflare IP
TLS SNI says:
"cdn.mangasite.ws"
But Host header says:
"actual-origin.site.ws"
Cloudflare routes to real origin
Publishers see Cloudflare IP
Can't determine real backend

Setup (Cloudflare Workers):

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  // Proxy to real origin
  const url = new URL(request.url)
  url.hostname = 'real-origin-hidden.com'

  return fetch(url, {
    headers: request.headers,
    method: request.method,
    body: request.body
  })
}

COST: $5/month (Cloudflare Workers)
BENEFIT: Real origin completely hidden

17. PWA OFFLINE READING

PWA Architecture Diagram

PWA OFFLINE READING FLOW

First Visit (Online):

User visits mangasite.ws
Service Worker installed
User reads Chapter 1
Service Worker caches:
├─ App shell (HTML/CSS/JS)
├─ Chapter 1 images (20 pages)
└─ Recently viewed chapters

Later (Offline):

1
2
3
4
5
6
User opens PWA (no internet)
        
Service Worker serves from cache:
├─ App works perfectly
├─ Chapter 1 loads instantly
└─ "You're offline" message for new content

When Back Online:

1
2
3
4
Service Worker syncs:
├─ Marks read chapters
├─ Downloads new chapters in background
└─ Shows notification: "5 new chapters available"

PART 4: OPERATIONS

18. MONITORING & ALERTING SYSTEM

What to Monitor

MONITORING DASHBOARD

CDN Health:
┌─────────────────────────────────────────────┐
│ BunnyCDN: ✓ Online | 45% traffic │
│ Cloudflare: ✓ Online | 35% traffic │
│ KeyCDN: ✓ Standby | 0% traffic │
│ Custom Asia: ✓ Online | 15% traffic │
│ Custom EU: ✓ Online | 5% traffic │
└─────────────────────────────────────────────┘

Proxy Layer:
┌─────────────────────────────────────────────┐
proxy1.ru: ✓ Active | 2ms latency │
│ proxy2.md: ✓ Standby | Ready │
proxy3.is: ⚠ Maintenance │
└─────────────────────────────────────────────┘

Origin Servers:
┌─────────────────────────────────────────────┐
│ origin1: ✓ Online | CPU: 45% │
│ origin2: ✓ Online | CPU: 38% │
│ MinIO: ✓ Healthy | Storage: 8.2TB │
│ PostgreSQL: ✓ Healthy | Connections: 45 │
└─────────────────────────────────────────────┘

Security Alerts:
┌─────────────────────────────────────────────┐
│ ⚠ 15 Japan IPs blocked (last hour) │
│ ⚠ Honeypot accessed 3 times (investigating) │
│ ✓ No unusual traffic patterns │
│ ✓ All SSL certs valid │
└─────────────────────────────────────────────┘

Traffic Stats (24h):
┌─────────────────────────────────────────────┐
│ Total Requests: 2.5M │
│ Bandwidth: 850 GB │
│ Cache Hit Rate: 94% │
│ Avg Response Time: 45ms │
│ Error Rate: 0.02% │
└─────────────────────────────────────────────┘

19. EMERGENCY FAILOVER PROCEDURES

Scenario 1: Primary CDN Gets DMCA

DMCA NOTICE RECEIVED BY BUNNYCDN

Hour 0: BunnyCDN sends notice

Auto-detection: Monitoring sees 403 errors

AUTOMATED RESPONSE:
┌─────────────────────────────────────────────┐
│ 1. Traffic routing updated (30 seconds): │
│ - BunnyCDN: 45% → 0% │
│ - Cloudflare: 35% → 60% │
│ - Custom servers: 20% → 40% │
│ │
│ 2. DNS updated (5 minutes): │
│ - cdn1.site.ws removed from rotation │
│ - cdn2.site.ws becomes primary │
│ │
│ 3. Users see no disruption │
│ - Automatic client-side failover │
│ - <1 second retry on failed images │
│ │
│ 4. Operator notified via Telegram │
│ │
│ 5. Backup CDN (KeyCDN) activated │
│ - Begin warming cache │
│ - Ready to take traffic in 1 hour │
└─────────────────────────────────────────────┘

Hour 1-24: Investigation & Response
├─ Review DMCA notice details
├─ Determine if BunnyCDN temporary or permanent
├─ If permanent: Shift to KeyCDN permanently
├─ If temporary: Wait for resolution
└─ Document incident for future prevention

Result: <5 minutes downtime, transparent to users

Scenario 2: Origin Server Compromised

ORIGIN SERVER BREACH DETECTED

Detection: Unusual access patterns logged

MANUAL RESPONSE (within 1 hour):
┌─────────────────────────────────────────────┐
│ 1. Isolate compromised server immediately │
│ - Disconnect from network │
│ - Block all inbound connections │
│ │
│ 2. Activate replica origin │
│ - origin2.internal becomes primary │
│ - Update proxy configurations │
│ - CDNs continue pulling from proxy │
│ │
│ 3. Forensic analysis │
│ - Review access logs │
│ - Identify breach vector │
│ - Check for data exfiltration │
│ │
│ 4. Deploy fresh origin server │
│ - New VPS, different provider │
│ - Restore from clean backup │
│ - Enhanced security measures │
│ │
│ 5. Gradual traffic shift │
│ - origin2 → new origin3 │
│ - Monitor for issues │
│ - Retire compromised server │
└─────────────────────────────────────────────┘

Result: Service continues, breach contained

Scenario 3: Mass Takedown (Multiple Components)

COORDINATED ATTACK: Multiple Services Hit

Simultaneous:
├─ BunnyCDN: DMCA takedown
├─ Cloudflare: Abuse complaint
├─ Domain: Registrar seizure notice
└─ Proxy: DDoS attack

EMERGENCY PROTOCOL:
┌─────────────────────────────────────────────┐
│ 1. Activate ALL backups simultaneously │
│ - Switch to KeyCDN + custom servers │
│ - Activate backup domain (.sh) │
│ - Rotate to standby proxy │
│ - Deploy emergency proxy if needed │


│ 2. Communication (within 30 minutes) │
│ - Post on X/Twitter: "New domain: .sh" │
│ - Update Reddit/Discord communities │
│ - Push notification via PWA │
│ │
│ 3. Infrastructure rebuild (24-48 hours) │
│ - New CDN accounts (different email) │
│ - New domain registrations │
│ - Fresh proxy servers │
│ - Enhanced security audit │
│ │
│ 4. Traffic recovery (1 week) │
│ - 80% users find new domain Day 1 │
│ - 95% recovered by Day 7 │
│ - Search engines re-index │
└─────────────────────────────────────────────┘

Downtime: 2-6 hours
Recovery: 90% within 24 hours

20. DETECTION DIFFICULTY COMPARISON

How Hard to Trace Your Infrastructure

SINGLE CDN (Easy):

1
2
3
4
5
6
Publisher investigates:
1. DNS lookupcdn.site.wsbunnycdn.net
2. "Ah, they use BunnyCDN"
3. Send DMCA to BunnyCDN
4. BunnyCDN compliessite slow/down
Time to identify: 5 minutes

MULTI-CDN + MASKING (Hard):

Publisher investigates:
1. DNS lookupcdn.site.wsYour custom nameservers
2. Multiple A records returned (geo-distributed)
3. Test requestsDifferent responses from different IPs
4. Some IPs return Cloudflare headers, some don't
5. TLS certs show different issuers
6. URL patterns are randomized/hashed
7. Some endpoints are decoys (honeypots)
8. Real origin IPs hidden behind proxy layer
9. Proxy IPs in Russia (ignores DMCA)
Time to fully identify: Weeks/months

MULTI-CDN + ROTATION + OBSCURATION (Very Hard):
├─ Weekly rotation of primary CDN
├─ Monthly rotation of proxy infrastructure
├─ Domain fronting via major providers
├─ Encrypted origin server addresses
├─ Traffic distributed across 50+ IPs
├─ No consistent patterns in URLs
├─ Multiple legal jurisdictions involved
├─ Payment trails completely anonymized (crypto)
├─ Registration details compartmentalized
└─ Real operators identity unknown

Time to fully identify: Months/Years (if ever) ✓✓✓

PUBLISHER'S INVESTIGATION REPORT:

1
2
3
4
5
6
7
"After 6 months of investigation, we have identified:
- 3 of 7 CDN providers (4 still unknown)
- 5 of 20+ proxy servers (15+ still hidden)
- 0 of 3 origin servers (all hidden)
- 0 operators (completely anonymous)
- Cost to continue investigation: $200K+
- Recommendation: Focus on easier targets"

PART 5: IMPLEMENTATION GUIDE

21. REAL-WORLD IMPLEMENTATION GUIDE

Phase 1: Foundation (Month 1)

START SIMPLE, SCALE UP

Week 1-2: Single CDN Setup
┌─────────────────────────────────────────────┐
│ 1. Deploy MinIO on Russia VPS │
│ 2. Setup BunnyCDN pull zone │
│ 3. Configure custom domain (cdn1.site.ws) │
│ 4. Upload test manga │
│ 5. Test end-to-end delivery │
│ │
│ Cost: $50/month │
│ Complexity: Low │
│ Takedown Risk: Medium │
└─────────────────────────────────────────────┘

Week 3-4: Add Proxy Layer
┌─────────────────────────────────────────────┐
│ 1. Deploy proxy VPS (Moldova) │
│ 2. Configure Nginx reverse proxy │
│ 3. Point BunnyCDN to proxy (not origin) │
│ 4. Firewall: Only proxy can access origin │
│ 5. Test failover │
│ │
│ Cost: $70/month │
│ Complexity: Medium │
│ Takedown Risk: Low-Medium │
└─────────────────────────────────────────────┘

Phase 2: Redundancy (Month 2-3)

ADD MULTIPLE CDNS

Month 2: Second CDN Provider
┌─────────────────────────────────────────────┐
│ 1. Setup Cloudflare pull zone │
│ 2. Configure custom domain (cdn2.site.ws) │
│ 3. Point to same proxy as BunnyCDN │
│ 4. Implement app-level load balancing │
│ - 50% traffic to BunnyCDN │
│ - 50% traffic to Cloudflare │
│ 5. Monitor performance of both │
│ │
│ Cost: $120/month │
│ Complexity: Medium │
│ Takedown Risk: Low │
└─────────────────────────────────────────────┘

Month 3: Add Backup CDN + Custom Servers
┌─────────────────────────────────────────────┐
│ 1. Setup KeyCDN (backup, inactive) │
│ 2. Deploy 2 edge VPS servers: │
│ - Tokyo (for Asia traffic) │
│ - London (for EU traffic) │
│ 3. Configure GeoDNS routing │
│ 4. Implement automatic failover │
│ │
│ Cost: $200/month │
│ Complexity: High │
│ Takedown Risk: Very Low │
└─────────────────────────────────────────────┘

Phase 3: Advanced Obscuration (Month 4+)

STEALTH MODE

Month 4: URL Obfuscation
┌─────────────────────────────────────────────┐
│ 1. Implement hashed URL paths │
│ 2. Add signed URLs with expiration │
│ 3. Deploy decoy endpoints │
│ 4. Setup IP logging for honeypots │
│ 5. Randomize CDN selection per user │
└─────────────────────────────────────────────┘

Month 5: Automated Rotation
┌─────────────────────────────────────────────┐
│ 1. Setup automated CDN weight rotation │
│ 2. Deploy 2nd proxy server (standby) │
│ 3. Implement monthly proxy rotation │
│ 4. Create rotation monitoring dashboard │
│ 5. Test emergency failover procedures │
└─────────────────────────────────────────────┘

Month 6: Full Stealth Mode
┌─────────────────────────────────────────────┐
│ 1. Add domain fronting (Cloudflare Workers) │
│ 2. Deploy 2 more edge servers (5 total) │
│ 3. Implement 4th CDN provider │
│ 4. Setup VPN detection + geo-blocking │
│ 5. Enable Japan/Korea IP blocking │
│ 6. Full monitoring + alerting │
│ │
│ Cost: $350-400/month │
│ Complexity: Very High │
│ Takedown Risk: Extremely Low │
│ Detection Difficulty: Months-Years │
└─────────────────────────────────────────────┘

22. MULTI-CDN COST BREAKDOWN

MONTHLY COSTS

CDN Providers:
├─ BunnyCDN: $100 (10TB @ $0.01/GB)
├─ Cloudflare Pro: $20/month base
├─ KeyCDN: $0 (standby, pay per use)
└─ Subtotal: $120/month

Custom Edge Servers (DIY CDN):
├─ Tokyo VPS: $15/month
├─ London VPS: $15/month
├─ NYC VPS: $15/month
└─ Subtotal: $45/month

Proxy Layer:
├─ Active Proxy (Russia): $20/month
├─ Standby Proxy (Moldova): $10/month
└─ Subtotal: $30/month

DNS & Load Balancing:
├─ Cloudflare Load Balancer: $5/month
├─ GeoDNS (NS1): $30/month
└─ Subtotal: $35/month

Monitoring:
├─ Uptime monitoring: $10/month
├─ Log analysis: $10/month
└─ Subtotal: $20/month

──────────────────────────
TOTAL: ~$250-300/month

TRAFFIC SUPPORTED: 10-30 TB/month
EXPECTED USERS: 1-5M visits/month
REDUNDANCY: High (no single point of failure)

23. IMPLEMENTATION CHECKLIST

✅ MULTI-CDN IMPLEMENTATION CHECKLIST

□ PRIMARY CDN (BunnyCDN)
□ Account created with burner email + crypto
□ Pull zone configured
□ Custom domain added (cdn1.site.ws)
□ SSL certificate auto-generated
□ Points to proxy layer (not direct origin)
□ Cache settings: 30 days

□ SECONDARY CDN (Cloudflare)
□ Pro plan activated ($20/month)
□ Page rules for cache everything
□ Custom domain (cdn2.site.ws)
□ Points to proxy layer
□ Rate limiting configured

□ BACKUP CDN (KeyCDN)
□ Account on standby
□ Pull zone pre-configured
□ Custom domain ready (cdn3.site.ws)
□ Can activate within 1 hour

□ CUSTOM EDGE SERVERS
□ VPS #1 deployed (Tokyo)
□ VPS #2 deployed (London)
□ Nginx reverse proxy configured
□ Cache storage allocated (50GB each)
□ Firewall rules (only CDN IPs)

□ PROXY LAYER
□ Active proxy (Russia) operational
□ Standby proxy (Moldova) ready
□ Firewall: Only CDN IPs allowed
□ Nginx configured for caching
□ Health monitoring enabled

□ LOAD BALANCING
□ Cloudflare Load Balancer configured
□ GeoDNS routing setup
□ Health checks every 30 seconds
□ Automatic failover tested
□ Traffic distribution verified

□ DOMAIN STRATEGY
□ Primary domain active
□ 5 hot standby domains configured
□ 10 cold backup domains registered
□ DNS TTL set to 300 seconds
□ All domains use WHOIS privacy

□ OBSCURATION
□ Custom domains mask CDN providers
□ URL obfuscation implemented (optional)
□ Signed URLs with expiration (optional)
□ Decoy endpoints deployed (optional)
□ Honeypot logging active

□ SECURITY
□ Japan/Korea IP blocking enabled
□ VPN detection configured
□ Rate limiting per IP
□ CAPTCHA for suspicious traffic
□ Firewall rules verified

□ MONITORING
□ CDN health checks (5 min)
□ Origin server monitoring
□ Proxy server monitoring
□ Telegram alerts configured
□ Log aggregation setup

□ AUTOMATION
□ Weekly CDN rotation script
□ Monthly proxy rotation script
□ Automatic failover tested
□ Emergency procedures documented

□ DOCUMENTATION
□ Infrastructure diagram created
□ Access credentials secured (password manager)
□ Runbook for common issues
□ Emergency contact list
□ Rotation schedule documented


PART 6: COST-BENEFIT ANALYSIS

24. DEPLOYMENT TIERS

TIER 1: BASIC ($150/month)

├─ 1 CDN (BunnyCDN)
├─ 1 Proxy server
├─ 5 backup domains
├─ Basic monitoring
├─ Setup time: 1 week
├─ Takedown risk: Medium
└─ Good for: Starting out, testing waters

TIER 2: STANDARD ($300/month)

├─ 3 CDN providers
├─ 2 Proxy servers (rotating)
├─ 10 backup domains
├─ Geo-blocking (JP/KR)
├─ Automated failover
├─ Setup time: 1 month
├─ Takedown risk: Low
└─ Good for: Serious operation, 1-5M visits

TIER 3: ADVANCED ($600/month)

├─ 5+ CDN providers
├─ 5 Proxy servers (mesh)
├─ 20+ backup domains
├─ VPN detection
├─ URL obfuscation
├─ AI routing
├─ Honeypot network
├─ Setup time: 3 months
├─ Takedown risk: Very Low
└─ Good for: 5-20M visits, high-profile

TIER 4: PARANOID ($1500/month)

├─ 10+ CDN providers
├─ 15+ Proxy servers (3 layers)
├─ 50+ rotating domains
├─ Blockchain domains (.crypto, .eth)
├─ P2P distribution (WebTorrent)
├─ Domain fronting (Cloudflare Workers)
├─ AI-powered routing
├─ Advanced VPN/proxy detection
├─ Honeypot network (10+ decoys)
├─ Signed URLs with rotation
├─ 24/7 monitoring + auto-response
├─ Weekly infrastructure rotation
├─ Multi-jurisdiction setup (5+ countries)
├─ Encrypted operator communications
├─ Cold wallet crypto payments only
├─ Zero-knowledge architecture
├─ Setup time: 6 months
├─ Maintenance: 10-20 hours/week (or hire team)
├─ Takedown risk: <0.1%
├─ Detection difficulty: Months/Years
└─ Good for: 20M+ visits, maximum paranoia

Best Value:

Hetzner Storage Box + VPS Combo
├─ VPS: 8GB RAM, 4 CPU = €20/mo
├─ Storage Box: 10TB = €30/mo
└─ Total: €50/mo (~$55/mo)

Location: Germany (good for EU, acceptable for DMCA)

Most DMCA-Resistant:

FlokiNET Iceland VPS
├─ 8GB RAM, 4 CPU, 200GB SSD
├─ Unmetered bandwidth
└─ $60/month

+ Separate storage VPS (Russia)
├─ 4GB RAM, 10TB HDD
└─ $40/month

Total: $100/month (Maximum protection)

Budget Option:

Contabo Germany VPS
├─ 12GB RAM, 6 CPU, 400GB SSD
└─ €15/month (~$16/mo)

Perfect for starting out!

26. SUMMARY: WHY THIS WORKS

THE MULTI-CDN ADVANTAGE

Single CDN Approach:

Publisher → Identifies CDN → DMCA Notice → Site Slow
Time to takedown: Days

Multi-CDN + Rotation:

Publisher → Identifies CDN #1 → DMCA Notice → 
  → Traffic auto-routes to CDN #2, #3, #4 →
  → By time they identify #2, #1 is back with new account →
  → By time they identify #3, infrastructure rotated →
  → Proxy layer changed, origin still hidden →
  → Custom domains mask new providers →
  → Publisher gives up (too expensive) ✓

Time to takedown: Months/Never
Cost to investigate: $100K-500K
Success rate: <20%

YOUR ADVANTAGES:

├─ Images vs Video (500x less bandwidth = 500x less cost)
├─ Lower profile (manga vs adult content)
├─ Multiple jurisdictions (Russia/Moldova/Iceland)
├─ Crypto payments (untraceable)
├─ Anonymous operations (no real identity)
└─ Automated failover (no human needed)


APPENDIX

Infrastructure Components

Security & Privacy

Advanced Features

Operations

Implementation


Document Version: 2.0
Last Updated: 2025-10
Status: Production Ready

Edit

Pub: 08 Nov 2025 18:15 UTC

Views: 57