Your website suddenly stops loading. You refresh the page again and again and get the same result: nothing. Is it a hosting fault? A plugin you installed yesterday? Or is someone doing this on purpose? That last case is a distributed denial-of-service (DDoS) attack. Forget the movie picture of a hooded figure in front of a black screen. The reality in 2026 looks more like a marketplace: infected home devices, sellers who rent out access to them, and customers who pay to knock out an opponent or to extort a company. This article explains the idea from the ground up, sets out what has actually been published about who is behind these attacks and what the authorities have done, and then gives you practical steps for your own site.
The short version: a DDoS attack floods a server or network with more traffic than it can handle, so real visitors cannot get through. The traffic comes from thousands of infected devices that the attacker controls remotely. It does not set out to steal your data. It knocks your site offline, and no single plugin stops it. You need layers of protection at the host, at the content delivery network (CDN) and on the site itself.
📋 Quick summary: DDoS in one table
| Item | In plain words |
|---|---|
| DDoS | Flooding a target (a site, a server or a network) with traffic from many sources until it cannot serve real visitors |
| DoS | The same idea from a single source, which is far easier to block |
| Botnet | A network of devices infected with malware (home gadgets, cameras, TVs) that the attacker controls remotely |
| Three main types | Volumetric (fills your bandwidth), protocol (drains server and network-equipment resources) and application (HTTP requests that look legitimate) |
| Scale | Cloudflare alone mitigated 47.1 million attacks in 2025 (the largest at 31.4 Tbps) and about 23.2 million network-layer attacks in the first half of 2026 |
| Who is behind it | Botnet operators who sell access, "attack-for-hire" services that let anyone with money launch an attack, and customers motivated by extortion or politics |
| Protection | Layers: host-level protection, a CDN, a web application firewall (WAF), rate limiting and an emergency plan |
What is a DDoS attack? The precise definition
Cloudflare defines it as a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target, or the infrastructure around it, with a flood of internet traffic. It compares this to an unexpected traffic jam that clogs a highway so regular traffic cannot reach its destination. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) describes a denial-of-service condition as one where legitimate users cannot reach information systems, devices or other network resources because of the actions of a malicious actor. The services affected can include email, websites and online accounts such as banking.
What does "distributed" mean?
The name is short for Distributed Denial of Service. In the older form (DoS), one machine sends the requests, so blocking its address is enough to end the problem. In the distributed form, the requests come from thousands or millions of devices in many countries. They are hard to block one by one and hard to tell apart from real visits. CISA says that distribution multiplies the attack's power and also makes its true source harder to identify.
Why does it work? Because every resource has a limit
Every server can handle only a limited number of requests at any moment, and every internet connection has limited capacity (see What Is Bandwidth). Once demand passes that limit, something in the chain gives way: the pipe fills up, the available connections run out, or the processor is busy generating pages for people who never wanted them. The attacker does not need a flaw in your site. Sending more than it can take is enough.
How does an attack work? From a device in someone's home to a site on the other side of the world
- Infection. The attacker spreads malware that exploits device vulnerabilities or factory-default passwords and takes control of the devices without their owners knowing. CISA notes that Internet of Things (IoT) devices are a common target because they often use default passwords and have weak security, and that an attacker can infect hundreds of thousands of them without the owners noticing.
- Recruitment. The infected devices become "bots" (or "zombies") and connect to a command-and-control (C2) server that waits for orders. All of them together make up the botnet.
- Command. The attacker picks the target, the attack type and the duration, and sends a single order to every bot.
- Flood. All the devices start sending requests to the target's IP address at the same moment, and the pipe fills up or the server chokes.
- The second victim. As CISA points out, the owner of the infected device (a TV, a camera or a router) is a victim too, and the device may be used in other attacks that the operator's customers have bought.
A live example: the Aisuru-Kimwolf botnet
In its report on the fourth quarter of 2025, Cloudflare describes Aisuru-Kimwolf as a huge collection of infected devices, mostly Android TVs, with an estimated 1 to 4 million hosts. On December 19, 2025 it began a campaign that Cloudflare named "The Night Before Christmas": 902 hyper-volumetric attacks (an average of 53 a day) that peaked at 24 Tbps, 9 billion packets per second and 205 million HTTP requests per second. Cloudflare compares the last figure to the combined populations of the UK, Germany and Spain all typing a web address and pressing Enter in the same second. Separately, the U.S. Department of Justice said in March 2026 that four botnets (Aisuru, KimWolf, JackSkid and Mossad) had together infected more than three million devices, most of them digital video recorders, web cameras and Wi-Fi routers.
Kinsta's WordPress hosting page says a firewall, DDoS protection and proactive monitoring are included
☑️ See Kinsta plans
Types of DDoS attack: three categories, by what they drain
Cloudflare groups attacks by the layer of the network connection they target. Each category is measured in a different unit, which is why the news talks about "terabits per second" in one story and "millions of requests per second" in another. Both are attacks, but they hit different points.
| Category | What it drains | Unit of measure | Well-known examples |
|---|---|---|---|
| Volumetric | The bandwidth between the target and the internet, filling the pipe | Bits per second (Gbps and Tbps) | UDP floods and amplification attacks such as DNS amplification |
| Protocol | Server resources or network equipment such as firewalls and load balancers, by exploiting weaknesses in layers 3 and 4 | Packets per second (pps) | SYN floods |
| Application | The layer where web pages are generated, because a single HTTP request can cost the server a lot of work | Requests per second (rps) | HTTP floods and Slowloris |
Examples that explain the difference
- SYN flood. The attacker sends requests to start a connection but never completes the "handshake." The connections stay half-open and occupy the ports until a real visitor finds no room (CISA's description).
- DNS amplification. A "reflection" attack: small queries with a spoofed source address (the victim's) go to open DNS resolvers, which reply to the victim with much larger responses (Cloudflare's explanation). To learn about DNS, read What Is DNS.
- DNS flood. The botnet aims its raw request volume at the authoritative DNS servers for the victim's domain, so the domain's "phone book" becomes unreachable and every service that depends on it goes dark (Cloudflare's explanation). DNS attacks of both kinds (flood and amplification) made up 34.3% of network-layer attacks in the first half of 2026.
- HTTP flood. Imagine millions of people pressing "refresh" in the browser at once. Each request looks legitimate, but the total drains the processor and the database, and it is one of the hardest types to tell apart from real visits.
In practice, attacks are often mixed. One 2025 example in Cloudflare's report is an 18-day campaign in the first quarter that combined SYN floods, attacks generated by Mirai malware and SSDP amplification. It came to roughly 13.5 million attacks aimed at customers of Cloudflare's Magic Transit service and at Cloudflare's own infrastructure, and Cloudflare's systems mitigated them automatically.
Who is actually behind these attacks?
There is no single gang. What the official sources publish describes a supply and demand chain with distinct roles, each with its own person and motive:
| Role | What they do | What the sources say |
|---|---|---|
| Botnet operator | Infects devices, controls them remotely and builds the network | The U.S. Department of Justice says the operators of Aisuru, KimWolf, JackSkid and Mossad used a "cybercrime as a service" model to sell access to the infected devices to other criminals |
| "Attack-for-hire" service (booter or stresser) | A website that lets any customer pay, pick a target and press a button | The department describes these services as having a low barrier to entry and says two of them (Vac Stresser and Mythical Stress) purport to launch tens of thousands of attacks a day. CISA adds that they let unskilled users launch attacks |
| Customer | Buys an attack against a target of their choice | Motives named in the sources: extortion, meaning a demand for payment to stop the attack (Department of Justice), and financial gain, ideological purposes or other motivations (SecurityWeek) |
| Politically motivated activists (hacktivists) | Launch attacks to knock offline the sites of groups they oppose, or sites linked to a political event | Cloudflare reports that within 72 hours of the strikes on Iran that began on February 28, 2026, security researchers recorded about 149 hacktivist DDoS claims against 110 organizations in 16 countries, 47.8% of them government |
| Owner of the infected device | Usually does not know their device is taking part | CISA says infected devices are victims too |
Who gets targeted?
The ranking shifts with events. In the fourth quarter of 2025, telecommunications, service providers and carriers were the most-attacked sector, with gambling and gaming third and fourth. Cloudflare explains that these sectors are critical infrastructure for others or are quickly hurt financially by an outage. In the first half of 2026, media, production and publishing led the list in both quarters with 14.2% of mitigated HTTP DDoS requests, nearly four times the runner-up. Cloudflare links this to the attention that coverage of the wars involving Iran and Ukraine and of the World Cup drew. The government sector jumped from 29th to 9th place in the second quarter. By country, China was the most attacked (22.4% of HTTP DDoS requests worldwide in the second quarter), followed by the United States (18.8%) and then Turkey. The Justice Department also lists victims such as schools, government agencies, gaming platforms and critical infrastructure. If your site is a news or publishing site, your sector had the highest share of HTTP DDoS requests in the latest report.
And what about a small site like yours?
CISA says there is no way to completely avoid becoming a target, and that networks can be harmed without being targeted directly: if the internet provider or cloud provider you rely on is attacked, your service goes down too. So it is not enough to ask "would anyone want my site offline?" The better question is "what has my host put between me and the flood?" To see how data centers work, read What Is a Data Center.
The numbers: how big was the problem in 2025 and 2026?
These figures come from Cloudflare's two latest reports (the 24th edition on 2025 and the 25th on the first half of 2026). They describe the traffic on its own network, which it says protects more than 20% of the web, so they are not a count for the whole internet. First, 2025:
| Indicator | Value in 2025 | Note |
|---|---|---|
| Total attacks mitigated | 47.1 million | More than double 2024 (up 121%), and up 236% between 2023 and 2025 |
| Average | 5,376 an hour | Of which 3,925 were network-layer attacks and 1,451 were HTTP attacks |
| Network-layer attacks | 34.4 million | Against 11.4 million in 2024, more than triple |
| Largest disclosed attack | 31.4 Tbps | It lasted only 35 seconds, and Cloudflare's systems mitigated it automatically |
| Fourth quarter | 78% | Network-layer attacks as a share of all attacks in the quarter |
Then the first half of 2026 (January to June):
| Indicator | Value in the first half of 2026 | Note |
|---|---|---|
| Network-layer attacks | 23.2 million | About 5,343 an hour (against 3,925 an hour for 2025), plus 29.64 trillion HTTP DDoS requests mitigated |
| Attacks over 1 Tbps | 935 | Of these, 805 came in the second quarter alone, more than six times the first quarter |
| The "typical" attack | Small and short | 96.62% of network-layer attacks were under 500 Mbps, and 90.60% ended in under 10 minutes |
| Most common type | DNS | DNS attacks were 34.3% of network-layer attacks, and DNS floods alone rose from 25.7% to 40.0% between the two quarters |
What the numbers mean for a site owner: the 31.4 Tbps attack shows the ceiling of what a huge botnet can do, not what an ordinary site will face, because most attacks are small and short. But Cloudflare points out that "small" is relative: a 100 Mbps attack is enough to overwhelm a server or website, and a 100 Gbps attack can knock most unprotected data centers offline. It adds that an attack may be brief while its aftershocks (routing instability, TCP retransmissions, application timeouts) can last hours or days, and it argues for always-on automatic protection instead of manual intervention. That is the view of a protection provider with a commercial interest in saying so. The practical question for you is not "how big can the biggest attack get?" but "is there a layer between my site and the flood that stops it?"
What have the authorities done? What was published in 2026
Botnet operators and attack-for-hire services have not been left alone. These are the main official announcements of 2026 (a charge in any case is not a conviction until a court rules):
| Date | Action | Source |
|---|---|---|
| March 19, 2026 | A court-authorized operation to disrupt the command-and-control (C2) infrastructure of the Aisuru, KimWolf, JackSkid and Mossad botnets, at the same time as actions in Canada and Germany against the people who operated them. Court documents allege that Aisuru alone issued more than 200,000 attack commands | U.S. Department of Justice |
| April 16, 2026 | Seizure of services tied to eight DDoS-for-hire domains (including Vac Stresser and Mythical Stress). The department said that more than 11 defendants had been charged and more than 100 domains seized over four years | U.S. Department of Justice |
| Mid-April 2026 | Operation PowerOFF with 21 countries taking part: 53 domains taken down, four arrests, 25 search warrants, 75,000 warning emails and letters sent to users of these services, and more than three million user accounts exposed | SecurityWeek, citing Europol |
| May 21, 2026 | A criminal complaint was unsealed against a Canadian man arrested in Ottawa on an extradition warrant, charged with aiding and abetting computer intrusion for allegedly administering the KimWolf botnet. Seizure warrants were also unsealed against services supporting 45 DDoS-for-hire platforms | U.S. Department of Justice |
These operations do not mean the problem is over. The Justice Department says its operation aims to disrupt the communication between the botnets and their devices and limit their ability to attack. In its report on the first half of 2026, Cloudflare says requests and traffic volume peaked in April (6.46 trillion requests and 165 petabytes) and fell afterward, and that this may reflect the effect of PowerOFF. That is a possibility, not a confirmed cause, and the same report counts 805 attacks over 1 Tbps in the second quarter. The practical meaning for you: do not rely on good news, rely on layers.
Is your site under attack, or is something else going on?
CISA says the symptoms of a denial-of-service attack can resemble non-malicious availability problems: unusually slow network performance, a particular site being unavailable, or being unable to open any site. The best way to diagnose it is to monitor and analyze network traffic. CISA also warns that attackers sometimes use a denial of service as a distraction while they attack other services on the same network, so keep an eye on your other systems. This table helps you do a first sort:
| Likely cause | Sign | What to do |
|---|---|---|
| DDoS attack | A sudden, very sharp rise in requests, often to one or a few specific URLs, from many scattered addresses, with no known marketing reason | Contact your host right away and ask for the access logs, and turn on your protection layers |
| Legitimate surge | A rise tied to an event: a paid ad, a viral share or a news story, with varied visitors browsing different pages | Add resources or turn on caching |
| Hosting outage | Failures show up on other sites on the same server, and the company's status page reports an incident | Follow the status page and open a ticket |
| A fault in your own site | It appeared after an update or a new plugin, and you see error messages, not only slowness | Restore a backup or disable the plugin |
How do you protect your site? Layers, not one fix
Cloudflare says the heart of mitigation is telling attack traffic apart from normal traffic, and it lists rate limiting, a web application firewall, scattering the attack across an Anycast network and routing traffic into a "blackhole." CISA recommends enrolling in a protection service that detects abnormal traffic flows and redirects traffic away from your network, so it can be filtered and the clean traffic passed on, and creating a recovery plan in advance.
| Layer | What it does | Who provides it | Note |
|---|---|---|---|
| Host-level protection | Filters traffic at the network before it reaches your site | Kinsta, Liquid Web and IONOS list DDoS protection on their pages. Namecheap ties it to its CDN service. Vultr sells it as an add-on at $10 a month per server (10 Gbps) | Compare what the plan actually includes before you subscribe |
| A CDN and Cloudflare protection | Sits between the visitor and your server and absorbs part of the traffic | Cloudflare says its DDoS protection is free and unmetered for all customers, runs in more than 330 cities and is backed by 500 Tbps of network capacity | Needs DNS setup, and it is partial protection that does not replace securing the site |
| Web application firewall (WAF) | Filters requests with rules, which blocks known HTTP flood patterns | Managed hosts, Cloudflare and security services | Needs tuning so it does not block real visitors |
| Rate limiting | Caps how many requests one address may make in a given period | The web server itself (such as Nginx), a CDN or a plugin | Not enough on its own against a botnet that spreads requests across thousands of addresses |
| Emergency plan | Who to call, where the backup is and how to tell visitors | You | CISA explicitly recommends one |
To read more about distribution networks, see What Is a CDN and What Is Cloudflare. The choice of hosting type matters for protection too: in cloud hosting the load can be spread across several servers, and on a self-managed VPS you set up the firewall and rate limiting yourself.
Liquid Web's WordPress hosting page lists DDoS protection, a web application firewall and an edge CDN powered by Cloudflare in every plan, and its VPS plans list DDoS protection too
☑️ See Liquid Web plans
What to do in the first hour if your site is attacked: steps
Write these steps down before you need them. Confusion during an attack wastes precious minutes:
Vultr: DDoS protection is an optional add-on at $10 a month per instance (10 Gbps of mitigation capacity per Cloud Compute instance), on top of the server price, according to Vultr's documentation
☑️ See Vultr servers
Common myths about DDoS
- "A DDoS attack is a hack of my site." It targets availability, not confidentiality: the goal is to take the service down, not to break in or read your data. That does not mean you can neglect your site's general security.
- "My site is small, so nobody will attack it." First, attacks are sold through services that are easy to buy. Second, you can be harmed without being the target (see CISA's point above about your hosting provider).
- "A strong password prevents it." It has nothing to do with it, because the attacker never needs to get into your site.
- "Blocking an IP address solves it." That works for an attack from one source (DoS). With a distributed attack there are thousands of addresses and they keep changing.
- "A CDN protects me from everything." It absorbs a lot, but if the address of your origin server becomes known, it can be attacked directly and bypass the CDN. That is why it is advisable for the origin server to accept traffic only from the CDN. A CDN is partial protection and does not replace a provider that stops the flood at the network.
- "The infected devices are all somebody else's." One of them could be yours: a camera with a default password or an old router. CISA says default passwords and weak security are a common reason these devices get infected, and it advises installing a firewall and antivirus software and reviewing security settings.
🎯 Who needs to care about this, and who can wait?
✅ It matters to you now if:
- Your site is a store or a service that loses money every minute it is down
- You run a VPS or cloud server yourself with no protection built in
- Your site is in a sector that is attacked often (gaming, gambling or telecom services)
- You are receiving threats or extortion messages
- You run smart devices (cameras or routers) on your network
⚠️ It is less urgent if:
- You have a personal blog on a host whose plan clearly states network-level protection
- Your site sits behind a CDN that is set up properly
- A few hours offline would not cost you anything important
🏆 The verdict: what to do after reading this
DDoS is not dark magic but plain engineering: the power of hijacked devices, sold to anyone who pays, against any IP address, with a low barrier to entry as the U.S. Department of Justice describes it. The good news is that defending against it is also well-known engineering, and the shortest route is to find out what stands between your site and the flood.
- Ask your host plainly: is there DDoS protection at the network level? What are its limits? Is it free or an add-on?
- Consider a CDN with Cloudflare's free protection for your site, especially if your audience is spread across regions.
- Prepare your first-hour plan (the steps above) and keep backups outside the server itself.
- Update your home devices and change their default passwords so they do not become part of the problem.
IONOS says its web hosting includes advanced DDoS shields, with 99.99% uptime on geo-redundant infrastructure
☑️ See IONOS hosting
✅ Frequently asked questions about DDoS attacks
❓ What is a DDoS attack?
❓ What is the difference between DoS and DDoS?
❓ Who is behind DDoS attacks?
❓ How many DDoS attacks are there?
❓ What is the largest DDoS attack ever recorded?
❓ Does DDoS steal my data?
❓ How do I know if my site is under a DDoS attack?
❓ Do a CDN and Cloudflare protect against DDoS?
❓ Does shared hosting include DDoS protection?
❓ What is Under Attack mode in Cloudflare?
❓ Is it legal to buy a DDoS attack against another site?
❓ Could my home device be part of a botnet?
Namecheap's shared hosting page says its plans include firewalls and DDoS protection with its CDN service
☑️ See Namecheap plans
Has your site ever gone down because of an attack? Tell us in the comments what you noticed and how you handled it.
Related articles you may find useful
☁️ What Is a CDN
How networks move content closer to the visitor and absorb part of the traffic. Read the guide
🌐 What Is Cloudflare
The service that sits between your visitors and your server to protect and speed it up. Read the guide
🖥️ What Is a Server
The machine that serves your site, and why it has a ceiling on requests. Read the guide
🛰️ What Is DNS
The directory that turns your site's name into an address, and how attackers abuse it. Read the guide
🏢 Kinsta Hosting Review
Managed WordPress hosting that lists protection and a CDN in its plans. Read the review
