fun to read all of this.
swsro files are much lighter than vsro ones.
a 4-gig machine is enough. even for those 500.
now, regarding ddos - believe me or not (i'm fed-up of this noob community, where every kid claims he knows it all)... you don't need a ddos protection. you just need someone who actually understands these kind of things and who can config your server to avoid these wanna-be-attacks (even if they might look mighty and effective

)
not intending to brag, but "my customers" don't have any paid-ddos-protection. they've got my configuration, and they are protected. The problem is that this forum is full of noobs who claim to know what "ddos" means. almost none of these people is even able to recognize which kind of attack is occurring. and terms like: dos,ddos,spoof,dns,syn,ack,flood blabla is everythign the same "ddos" for these experienced people who get food cooked from their parents

.
Let someone expereinced configure your server, you'll be saving windows license costs (as linux as host machine is better anyway

) and you won't be paying 1000s of $ just to mitigate an attack of little wanna-be-hacker-kids who got their hands on some random tools.
use a kimsufi or hetzner server for your needs.
here are some tips:
- cpu is completely irrelevant as long it isn't a 486
- min 4gb ram. 8gb recommended for the ddos-mitigation-thingy

- hdd - completely irrelevant
- no need for a 1gbit connection. totally useless
- not above ms server 2003 and mssql2000 (the 100th time - these ******* files were made for this database/os type! everything above is a waste and a risk. get rid of the stupid idea "new=better"!)
greetings.
PS: i won't repeat myself and fight with the know-it-all-better-kids on this forum.
believe in what you want. I myself work in this area in my life outside the net. how about the others?