IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Here Are the Top 10 Countries Where DDoS Attacks Originate

As cyber attacks, including denial-of-service hacks, increase worldwide amid the war in Ukraine, we take a look at data from Cloudflare showing the countries with the highest concentration of DDoS traffic.

Behind the physical destruction of Russia’s invasion of Ukraine, a cyber war has raged as well — Cloudflare, as well as others, have tracked a significant spike in hacking activity worldwide since the war began.

It will take time to understand who “wins” that war, and in the digital age it will also take time to even understand who was participating. But for a baseline, Cloudflare has released data to show the top 10 countries where a certain kind of hack is coming from — specifically, application-layer distributed denial-of-service (DDoS) attacks.

A DDoS attack involves directing large amounts of traffic, often from a bot network, to a system in order to overwhelm its capacity and prevent it from performing its functions. An application-layer attack specifically targets the place where a human would interact with that resource; an easy example is hackers flooding a website with traffic so that it won’t load for legitimate users.

According to Cloudflare, the top 10 sources of DDoS attacks are:
  1. China
  2. U.S.
  3. Brazil
  4. India
  5. Malaysia
  6. Indonesia
  7. Russia
  8. Germany
  9. Ukraine
  10. Spain

The data measures the percentage of total traffic in a country associated with DDoS attacks, but the list more or less reflects many of the top countries in the world by population. Three of the countries on the list, however — Malaysia, Ukraine and Spain — appear to be “punching above their weight,” with relatively small populations compared to the other big hacking countries.
The other countries that made the top 10 in at least one quarter of 2021 were Argentina, France, the U.K. and Thailand. Conversely, large countries that didn’t make the list include Pakistan, Nigeria, Bangladesh and Mexico.

Although it hasn’t updated its data in some time, more general hacking numbers from Akamai in the past have put Turkey, Taiwan, Romania, Italy and Hungary among the most active countries for hacking activity in the world.
Ben Miller is the associate editor of data and business for Government Technology. His reporting experience includes breaking news, business, community features and technical subjects. He holds a Bachelor’s degree in journalism from the Reynolds School of Journalism at the University of Nevada, Reno, and lives in Sacramento, Calif.