Ask HN: What is the most secure way to host a form-driven website for an ICO

I was approached through a friend of a friend of a friend, to help with their ICO - (full disclosure - their product is crap and they just wanted to get into the craze, and I lovingly declined) -

BUT it got me thinking about the 'best way' to host a site for something like this. So I spent a few hours investigating and there isn't anything particularly conclusive that seems to incorporate recent events ( ICO hacks, DNS attacks, fakeurls, ransomware, etc ) and I didn't seem to find any previous discussion on HN about this, and so here we are..

Goal: Host a secure website which takes in user data safely, built to withstand 2018 ICO-attacks, and scale up as needed.

HN Goal: Turn this post into a reference point for others to help with their projects

Bugs/Features:

* Verify to the user that they are on the correct site in the first place

* Heavily guarded against brute-force attacks ( ssh, dos, mitm, remote exploits, etc )

* Capture some user data ( email address, wallet address, Name )

* Verify the user is who they say they are - or at least not a duplicate ( Email, 2FA, IP/Location tracking, or 3rd-party service )

* Provide feedback to the user for a successful entry

* Have a scalable-type solution for the DB

* Be able to handle 'lots' of users ( lets pretend needs to be working for: one million ants )

Couple of initial ideas for hosting:

* Lots of layers of caching ( Multiple CDN and Caching providers )

* Serverless Approach ( Lambda + AWS / GCE API-driven DB )

* Serverfull approach ( ec2 instance w/ selinux, lock down as much as possible, nginx/apache, TLS 1.3, high-bit security keys, etc, etc)

* ???

* Profit