[Ganzor]

Even with IIS you could purchase a server from a host with DDoS protection, though I fully agree for the once a year downtime for less than a day (on average) it isn't worth the extra $100 per month or so that they tend to charge. If you do purchase one with DDoS protection they will temporarily bump your bandwidth up to as high as 15Gbps for some hosts, as well as have their own customized firewall filtering out http floods and other attacks before they ever touch your server.

Again though, the extra cost is probably not worth the tiny amount of downtime per year.