Methods and apparatus for distributed Internet backbone DDOS (distributed denial of service) mitigation via transit providers. A provider network may include a data center and a remote point of presence (RPOP) linked to the data center by private backbone links. The data center may include servers, a traffic analyzer and a routing information generator. The traffic analyzer determines a target address to which a pattern of traffic matching a profile is detected. The routing information generator may generate new routing information for the target address that avoids the use of the backbone, and provide the information to an IP transit provider. The IP transit provider propagates the new routing information to the RPOP, which directs subsequent traffic to the target address over a path that excludes the backbone.