Assessing the aftermath : the effects of a global takedown against DDoS-for-hire services

Tools

Vu, Anh V. and Collier, Ben and Thomas, Daniel R. and Kristoff, John and Clayton, Richard and Hutchings, Alice (2025) Assessing the aftermath : the effects of a global takedown against DDoS-for-hire services. In: 34th USENIX Security Symposium, 2025-08-13 - 2025-08-15. (In Press)

[thumbnail of Vu-etal-2025-Assessing-the-aftermath-the-effects-of-a-global-takedown-against-DDoS-for-hire-services] Text. Filename: Vu-etal-2025-Assessing-the-aftermath-the-effects-of-a-global-takedown-against-DDoS-for-hire-services.pdf
Final Published Version
Restricted to Repository staff only until 13 August 2025.
License: Strathprints license 1.0
Download (1MB) | Request a copy

Abstract

Law enforcement and private-sector partners have in recent years conducted various interventions to disrupt the DDoSfor-hire market. Drawing on multiple quantitative datasets, including web traffic and ground-truth visits to seized websites, millions of DDoS attack records from academic, industry, and self-reported statistics, along with chats on underground forums and Telegram channels, we assess the effects of an ongoing global intervention against DDoS-for-hire services since December 2022. This is the most extensive booter takedown to date conducted, combining targeting infrastructure with digital influence tactics in a concerted effort by law enforcement across several countries with two waves of website takedowns and the use of deceptive domains. We found over half of the seized sites in the first wave returned within a median of one day, while all booters seized in the second wave returned within a median of two days. Re-emerged booter domains, despite closely resembling old ones, struggled to attract visitors (80–90% traffic reduction). While the first wave cut the global DDoS attack volume by 20–40% with a statistically significant effect specifically on UDP-based DDoS attacks (commonly attributed to booters), the impact of the second wave appeared minimal. Underground discussions indicated a cumulative impact, leading to changes in user perceptions of safety and causing some operators to leave the market. Despite the extensive intervention efforts, all DDoS datasets consistently suggest that the illicit market is fairly resilient, with an overall short-lived effect on the global DDoS attack volume lasting for at most only around six weeks.

ORCID iDs

Vu, Anh V., Collier, Ben, Thomas, Daniel R. ORCID logoORCID: https://orcid.org/0000-0001-8936-0683, Kristoff, John, Clayton, Richard and Hutchings, Alice;
CORE (COnnecting REpositories)