The single biggest change in the DDoS threat landscape over the past decade is not a new attack technique — it is a business model. DDoS-for-hire services, marketed as 'booters' or 'stressers', turned attacks into a retail product. For the price of a takeaway meal, anyone can rent hundreds of gigabits of flooding capacity for an hour, launched from a web dashboard with no technical skill required. Understanding this market is understanding why your threat model has to assume you will be attacked eventually.
How Booter Services Operate
- Operators rent botnet capacity from criminal infrastructure or build their own from compromised servers.
- Customers pick an attack type (UDP flood, HTTP flood and so on), a duration and a target, from a dashboard.
- Attacks launch through an API — no skill, no tooling, no understanding of what is happening under the hood.
- Prices run from around $10 for a 60-second burst to $500+ for sustained multi-hour attacks.
The services hide behind a thin legal fiction — they call themselves 'IP stressers' for 'testing your own infrastructure' — but the marketing, the targeting features and the payment in cryptocurrency make clear what they are actually selling.
A Resilient Criminal Market
- Europol's 2022 operation 'PowerOFF' seized 48 booter services in a coordinated takedown.
- Within weeks, new services filled the gap — the market absorbs takedowns and continues.
- Estimates put thousands of unique booter customers launching attacks on any given day.
- The price of an attack has fallen roughly 90% since 2013; commoditisation is complete.
Illegal, and prosecuted
Using a booter against any target you do not own or have written permission to test is a crime in every major jurisdiction. Convictions under the US CFAA and the UK Computer Misuse Act carry real prison sentences, and law enforcement increasingly pursues customers, not just operators, using the services' own payment records.
What This Means for Your Defence
The democratisation of attack capacity changes who you have to defend against. It is no longer only sophisticated criminal groups; it is a disgruntled customer, a petty competitor, a teenager with a grudge and a debit card. The barrier to launching an attack is now trivially low — so the barrier to defending against one has to be equally low to cross. That means protection that is always-on, automatic, and does not depend on a human noticing and reacting.
This is precisely the model Akarguard is built on: protection sits in the traffic path via a DNS change so it is always live, automatic mitigation escalates the moment an attack is detected, and your origin stays hidden so a booter pointed at your old address hits nothing. When anyone can buy an attack for $10, 'we'll set up protection if it happens' is not a plan — being behind it already is.