Step 1: start up a noname site, ensure you are not indexed, do not advertise Step 2: Enable cloudflare, paid tier, hang around with it turned on for a month or

Step 1: start up a noname site, ensure you are not indexed, do not advertise Step 2: Enable cloudflare, paid tier, hang around with it turned on for a month or so Step 3: Simulate some usage traffic Step 4: Cancel your cloudflare contract Step 5: Watch your unknown site get ddosed Coincidence? Suuuuuure Cloudflare itself doesnt need to ddos you, plenty of ddos for hire outfits out there that will happily do it. As to who hires them, well that's between them and their customers. But there are some things that are not coincidences.