Abstract: The present disclosure generally relates to systems and methods for utilization of network mitigation techniques in the form of null address routing to mitigate coordinated DDOS attacks. One or more computing devices can install malware code into a network device after exploiting a vulnerability of the network device. A monitoring and mitigation service can monitor network devices and detect malware code installed on the network-based service. The monitoring and mitigation service can identify the internet protocol (IP) address or any routing information regarding the computing devices that sent the malware code. Based on the identified information, the monitoring and mitigation service can identify and implement the network mitigation information in the form of null routing addresses that will cause network communications associated with the identified computing device to be terminated or otherwise not delivered to the intended network-based resources.