> This is the most convoluted conspiracy theory I've read so far this decade. You must not get out much. :) > things are easy to notice with some saved twitt

> This is the most convoluted conspiracy theory I've read so far this decade. You must not get out much. :) > things are easy to notice with some saved twitter searches and a google alert? They are not doing this through twitter searches or google alerts. They show up when there is absolutely no mention of it anywhere, even sometimes when the attack is largely ineffective. Expectations like yours-- that they could only discover them from public sources-- probably contributes to people believing the attacks originate from cloudflare. They use sampled netflow data from ISP to detect large scale DDOS attacks (presumably buying the information from arbor networks or similar, where they don't have their own coverage).