A method for congestion recovery during a denial of service attack involves creating a split horizon zone on a server, where the split horizon zone includes a fictitious zone mapped to a fictitious address, receiving and investigating requests from clients, designating a malicious client based on investigating the requests, where the malicious client is associated with a client address, assigning the client address to the fictitious zone, and routing network traffic from the malicious client to the fictitious address.