nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpqf66e974nrmhl3pp6s96zzp9qeuw9kz9j087qk5k7zs5v7xua9e3qn7g800 (nprofile…g800) At the ICANN Tech Day in March 2016, .tr shared a post-mortem and recommendations following their incident. Details here: https://archive.icann.org/meetings/icann55/marrakech/downloads/presentation-ddos-07mar16-en.pdf.
I remember out-of-band communication (telephone numbers) and for TLDs contact IANA/ICANN.