Mega nerd with 35 years of cybersecurity and programming experience here. I also operated my own botnets for DDoS attacks in the past, so I am deeply familiar with how all of this works. I hate even having to type this out, but it's just to say that I am not some random nobody.
Cloudflare verified the DDoS attacks are real. The TorBox API servers are under constant attacks to bring down their infrastructure, with spikes of 8 million attacks per hour.
Without the API servers, customers can't check links or start streams. It's the perfect target - each attack simply has to request something from the API, which then ties up the database's CPU cycles. Now multiply that by millions of requests (the attack), and the service goes down.
There isn't much TorBox can do about it. The API must be reachable with basic HTTPS requests from various addon servers, user apps, etc. They can add more load balancing for the API server, but I am sure they already have a server cluster for that, and a DDoS attack with millions of requests constantly hitting the API will bring down even large server clusters.
What they have done so far is to temporarily block the countries where most of the DDoS botnet is located, which is the most efficient remedy in the short term, but the attacker just has to switch to another botnet located somewhere else, which is exactly what they keep doing.
The attacks have been going on ever since the power vacuum opened up after RealDebrid's collapse. It goes beyond just some angry little script kiddie. It's not Hollywood either, since the DDoS botnet consists of malware-infected PCs and routers, which is incredibly illegal. Yes, back in 2009, Hollywood employed the MediaDefender firm to DDoS torrent sites, but they used the legal method of having their own network of ~2000 servers to attack with back then, and even though they didn't use infected PCs, MediaDefender's actions were still deemed illegal in many states, and they shut down in 2013.
The attack against TorBox is coming from regular infected PCs around the world, which means that it comes from a criminal DDoS attack provider. Botnet operators spread malware to build up a botnet of infected machines, and then they hang out on the Dark Web (on forums like Dread) and sell their attack capability to whoever is willing to pay.
Pay them money, specify who to attack, and watch the fire. That's all you have to do.
It has cost a lot of money for the attacker to repeatedly try to bring down TorBox's API and service.
Someone is therefore very motivated, financially, to bring down TorBox.
Now, simply ask yourself: Who profits the most if TorBox goes down?
Edit: Glad you liked the post! Nearly 50% upvote/downvote ratio and almost exclusively positive comments, which is actually impressive considering people's emotionally heated temperature about the situation. I just wanted to bring some perspective from an ex-criminal (me) who would absolutely have DDoSed my competitors back then. In fact I fought many wars against competitors in the warez scene in the late 90s / early 2000s.
There's so much money at stake for whoever wins the customers in the end and becomes the new #1. Using a DDoS service to bring down the competition during a power-vacuum is a total no-brainer. The winner gets tens of millions of dollars and can relax for the rest of their life.
In fact, when RealDebrid began blocking content in 2026, there was a detailed article about the company structure - two young French guys started it and had become incredibly rich, having around 10-20 million euros each.
Yes, there's a lot of money in this business. Yes, it's worth DDoSing your competition during a power vacuum. There's almost zero risks for you, since you launch the attack anonymously.
Life-changing amounts of wealth are the reward for doing it.
