DDoS attack
Also known as: DDoS, distributed denial-of-service attack, distributed denial of service
A distributed denial-of-service (DDoS) attack tries to knock a website, app, or network offline by overwhelming it with traffic or requests from many sources at once, often a botnet of hijacked devices.
Legitimate users then can't get through. While DDoS attacks don't usually steal data, they can cost businesses sales, damage reputations, and serve as distractions for other attacks.
DDoS attack, explained at three levels
At home
Imagine thousands of people, all sent by one prankster, crowding into a small shop at once, so real customers can't get through the door. A DDoS attack does that to a website. The attacker orders thousands of hijacked devices to send traffic at the same moment, and because it comes from everywhere, blocking any one sender doesn't help.
At work
A distributed denial-of-service attack floods a company's website, app, or network with traffic from thousands of sources at once, so real customers can't get through. It doesn't usually steal data, but it can stop online sales, frustrate users, and sometimes distract staff from a quieter break-in. Businesses defend by routing traffic through protection services that absorb the flood and filter out fake requests.
At home
Every website has limits: how much internet bandwidth it has, how many connections its equipment can track, and how many requests its servers can answer each second. A DDoS attack pushes past one of those limits. The attacker commands thousands of hacked computers, routers and cameras to send traffic at once, so real visitors cannot get through. Because the traffic comes from so many ordinary devices worldwide, blocking one address does nothing.
At work
Attacks come in three layers. Volumetric floods fill the network pipe, often using reflection and amplification, where a small spoofed request to a misconfigured server, such as DNS or memcached, triggers a much larger reply aimed at the victim. Protocol attacks such as SYN floods exhaust connection tables in firewalls and load balancers. Application-layer attacks send realistic web requests that are expensive to answer. Mitigation services absorb the traffic across large networks and filter out the bad requests before forwarding the rest.
At home
A home internet connection has a small fraction of the capacity a website has, so it takes very little traffic to knock one offline. Gamers and streamers sometimes get targeted after an opponent learns their home IP address, often through a peer-to-peer voice chat or game connection. Rebooting the modem may give you a new address, but not always. In my view, using platforms and settings that hide your IP address is a sensible precaution for anyone who plays competitively.
At work
Record attacks now exceed several terabits per second, driven by botnets of compromised servers and IoT devices and by protocol flaws such as HTTP/2 Rapid Reset in 2023. Defence is architectural: put public services behind a CDN or scrubbing provider, hide origin IP addresses, use anycast to spread load, and agree on escalation paths with your ISP in advance. Rate limiting and caching blunt application floods. Because DDoS is also used for extortion or as cover for intrusions, watch for other activity during an attack.
Real-world examples
At home
Nadia tried to renew her fishing licence online, but the provincial website wouldn't load. News later reported it had been hit by a DDoS attack from a hacktivist group.
At work
Jerome runs IT for a Canadian online ticket seller. Moving the site behind a DDoS protection service kept it online during a large attack timed for a major concert sale.
How it compares
| feature | DDoS attack | DoS attack |
|---|---|---|
| Sources | Many devices at once | Usually one source |
| Blocking | Hard, traffic comes from everywhere | Easier, block one source |
| Scale | Can be enormous | Limited |
| Typical tool | Botnet | Single machine or script |
A DoS attack is one attacker. A DDoS is an army.
For analysts
For any business that sells or serves online, I'd confirm DDoS protection is in place before peak seasons. Setting it up during an attack is much harder.
History & origin
In February 2000, a 15-year-old from Montreal known as 'Mafiaboy,' Michael Calce, launched DDoS attacks that briefly knocked Yahoo, CNN, eBay, Amazon, and other major sites offline, drawing global attention to the threat. Hacktivist groups such as Anonymous used DDoS in protests in the early 2010s. The Mirai botnet's 2016 attack on DNS provider Dyn disrupted major services across North America. Attack sizes kept growing: in 2025, Cloudflare reported blocking attacks above 11 terabits per second, with even larger records following later that year. Pro-Russian hacktivist groups have also repeatedly targeted Canadian government and business websites since 2022. In my view, it's remarkable that a teenager from Montreal set the template for an attack still disrupting the internet decades later.