DDoS-as-a-Service
Also known as: Booter, Stresser, DDoSaaS
A commercial service that rents out DDoS attack capacity by the minute through a web dashboard, lowering the skill barrier for launching denial-of-service attacks.
Last updated:
What is DDoS-as-a-service?
DDoS-as-a-service (also marketed as booter or stresser services) is the commercial productization of the DDoS attack. A customer pays a subscription fee — typically $10 to $300 per month — and gets access to a web dashboard where they enter a target IP or domain, pick an attack method, set a duration, and click "launch." The actual attack traffic comes from the service provider's botnet or from amplification infrastructure they've scouted.
Why these services exist despite being illegal
Running DDoS-for-hire is a crime in most jurisdictions and the US and UK have brought repeated takedown operations against large booter operators. Yet the market persists because:
- Low skill barrier — the customer doesn't need to own a botnet or know how DDoS works
- Plausible cover story — services market themselves as "stress testers" you can use "on your own servers"
- Small transactions — most attacks last minutes and cost dollars, which makes law-enforcement cost/benefit difficult
- Resilient infrastructure — providers rotate domains, payment processors, and hosting after each seizure
Detection and defense
Traffic from a booter is still DDoS traffic — it shows the familiar fingerprint of a huge number of source IPs sending identical, low-value requests. Upstream DDoS mitigation (Cloudflare, AWS Shield, dedicated scrubbing providers) is the only practical defense against serious volume. For smaller targets, blocking at the edge by country, ASN, or abuse-list membership can reduce impact. The source IPs of a booter attack are usually already cataloged — running them through an IP abuse report checker typically returns a long history of prior reports.