Not from servers. From homes.
Blocklists were built for a time when attacks came from a few rented servers. Today's large Layer 7 floods are sent through residential proxy networks and infected home devices: routers, cameras, phones and computers on ordinary internet connections.
The two floods we measured in October 2026 show it. The first came from about 889,000 addresses in 52 countries, the second from about 1.07 million in 58. Both averaged fewer than two addresses per /24 network, and their largest networks were the household names of home internet: Comcast, AT&T, Verizon, Virgin Media, Rostelecom, Chinanet.
The crowd changes faster than the list
- Every minute brings new addresses. In the first flood, 98% of the second minute's addresses had not been seen in the first. A list built from minute one missed almost all of minute two.
- Each address sends little. In the first flood's busiest minute, 430,000 addresses sent about two requests a second each. Nothing about a single address stands out.
- Yesterday's list covers half. A list of every address from the first flood would have held about 44% of the second flood's addresses, two days later.
- The addresses are shared. Mobile networks and many home providers put many customers behind one public address, and reassign addresses all the time. An address on your list today is a customer's tomorrow.
The networks are your customers' providers
No single network sent as much as 5% of either flood. The ten largest together sent less than 18% of the first and less than 22% of the second. To block most of a flood by network you would have to block hundreds of networks, starting with the largest home and mobile providers in the United States, Europe, Latin America and Asia, and every customer on them.
The flood comes from your country too
The largest country in both floods was the United States, with 14% and 15% of the requests. The rest was spread over dozens of countries, with no clear centre to cut off.
Allowing only your own country looks like a way out, but it locks out every customer abroad, every traveller and every visitor on a VPN, and the part of the flood that comes from devices in your own country still gets in.
Judge the client, not its address
What tells a flood apart from real visitors is what each client shows on its own connection and requests: whether it behaves like the browser it claims to be and whether it acts like a person. That evidence comes with every request, from any address, in any country.
So the door stays open. A client nobody has seen before is checked, not refused. A client that shows the evidence of a flood is stopped, and only that client: the next customer on the same network, behind the same shared address, still gets in. This is how Shieldify decides, for every request, during every attack.
Country rules still have a place: as your own choice for your own business, not as DDoS protection. More in What is a Layer 7 DDoS attack?