DDoS booters and IP stressers are web-based services that sell DDoS attacks on demand, allowing anyone with a credit card to launch an attack against an IP address or domain without any technical knowledge. Also called DDoS-for-hire services, they commoditized what previously required significant botnet infrastructure and expertise.
TL;DR: DDoS booters and IP stressers are criminal services that sell DDoS attacks on demand — no technical knowledge required. They are illegal to use against targets you do not own, with penalties including federal prosecution under the Computer Fraud and Abuse Act. Protecting against booter attacks requires the same layered DDoS mitigation as any other attack: edge-based scrubbing, rate limiting, and WAF rules.
Last updated: 2026-07-27
What Is a DDoS Booter?
A DDoS booter is a subscription or pay-per-use service that provides DDoS attack capabilities through a web interface. Users enter a target IP or domain, choose an attack method and duration, and the service launches the attack. Booters market themselves as “stress testing” tools for server owners to test their own infrastructure—a legal framing that the industry, law enforcement, and courts have largely rejected.
Booters emerged around 2012 and proliferated through online gaming communities where players used them to knock opponents offline during matches. By 2016, booter services were responsible for millions of attacks per year, according to Europol.
What Is an IP Stresser?
IP stresser and booter are used interchangeably. The term “stresser” references the claimed legitimate use case: stress testing one’s own infrastructure. In practice, the same services are used to attack third parties. Some stresser services attempt to add a veneer of legitimacy by requiring users to claim they own the target—a check that is never enforced.
How DDoS-for-Hire Services Work
1. Attack infrastructure
Booter services do not typically use their own infrastructure directly. Instead, they rely on:
- Botnets of compromised devices: IoT devices, servers, and PCs infected with malware
- Open resolvers and amplifiers: Public DNS, NTP, SSDP, and Memcached servers misconfigured to respond to spoofed requests
- Bulletproof hosting: Servers hosted in jurisdictions that ignore abuse complaints
2. Attack methods offered
| Attack Method | Layer | Typical Volume | Notes |
|---|---|---|---|
| UDP Flood | 3-4 | 10–500 Gbps | Most common booter method |
| DNS Amplification | 3-4 | 50–500 Gbps | High amplification ratio (~70x) |
| NTP Amplification | 3-4 | 50–400 Gbps | Amplification factor ~100x |
| SYN Flood | 4 | 10–100 Gbps | Connection table exhaustion |
| HTTP Flood | 7 | 1M–50M RPS | Targets web applications |
| SSDP Amplification | 3-4 | 10–200 Gbps | UPnP-enabled devices |
3. Pricing and availability
Before major law enforcement actions in 2018 and 2022, booter services offered:
- Plans starting at $5–$10 per month for short attacks
- Premium plans at $100–$400/month for unlimited attacks up to several Gbps
- Attack durations from 30 seconds to 24 hours
4. User interface
Booters provide a web dashboard where users:
- Enter target IP or domain
- Select attack method and duration
- Monitor attack status
- View “attack logs” showing packets sent
This interface makes attacking as accessible as sending an email.
Scale of the Problem
The FBI and Europol’s Operation PowerOFF—a coordinated law enforcement action targeting booter services—seized 49 domains in December 2022 and arrested multiple operators. Prior to the action, the seized services had collectively launched over 30 million DDoS attacks.
Public law-enforcement actions show that booter services make DDoS attacks accessible to low-skill attackers, especially lower-volume attacks that target games, small businesses, schools, and personal websites.
Legal Status
Using a DDoS booter to attack any target other than your own infrastructure is illegal in most jurisdictions:
| Jurisdiction | Relevant Law | Maximum Penalty |
|---|---|---|
| United States | Computer Fraud and Abuse Act (CFAA) | 10+ years imprisonment |
| European Union | Directive on Attacks Against Information Systems | 2–5 years imprisonment |
| United Kingdom | Computer Misuse Act 1990 | Up to 10 years imprisonment |
| Australia | Criminal Code Act 1995 | Up to 10 years imprisonment |
Law enforcement agencies including the FBI, Europol, NCA (UK), and Australian Federal Police have consistently prosecuted both booter operators and users. The FBI’s “Booter Initiative” resulted in charges against hundreds of individuals. Courts have rejected the “I own the target” defense when users attacked third parties.
Purchasing a booter subscription alone can be sufficient for charges of conspiracy to commit computer fraud in some jurisdictions, even if no attack is launched.
How Booter Attacks Differ from Sophisticated DDoS Campaigns
| Characteristic | Booter Attack | Sophisticated DDoS Campaign |
|---|---|---|
| Technical sophistication | Low (point-and-click) | High (custom infrastructure) |
| Attack volume | 1–50 Gbps typical | 100 Gbps–3+ Tbps |
| Attack duration | 30 seconds–24 hours | Hours–days |
| Cost to attacker | $5–$400 | Thousands–millions |
| Attribution risk | High (attacker has an account) | Low (sophisticated evasion) |
| Multi-vector capability | Limited | Extensive |
Booter attacks are generally lower volume than nation-state or organized criminal DDoS campaigns. However, attacks from a single booter service targeting a small organization with inadequate protection can still cause complete service outages.
How to Protect Against Booter-Generated Attacks
Booter attacks predominantly use volumetric and amplification methods at Layers 3–4. Standard DDoS protection strategies are effective:
- Always-on DDoS mitigation: Booter attacks can launch in seconds. Manual activation of mitigation is often too slow. Always-on protection absorbs traffic without requiring operator intervention.
- Rate limiting at the network edge: Limits packets per second from any single source, reducing the impact of UDP floods.
- Amplification source filtering: Block inbound UDP responses from known amplification sources (DNS/NTP servers you did not query). BCP38 network ingress filtering at the ISP level reduces spoofed traffic.
- IP reputation feeds: Many booter services reuse known botnet IPs. IP reputation databases can pre-block known attack sources.
- WAF for HTTP-based booter attacks: Layer 7 booter attacks require application-level filtering that a WAF provides.
Frequently Asked Questions
What is a DDoS booter? A DDoS booter is a paid online service that launches DDoS attacks against any target on demand. Users access a web interface, enter a target IP or domain, and the service generates attack traffic using botnets or amplification methods. Booters require no technical skill to use.
Are IP stressers legal? Using an IP stresser against any infrastructure you do not own is illegal under computer-crime statutes in the United States, European Union, United Kingdom, and most other jurisdictions. Even using a stresser against your own infrastructure can attract scrutiny if the traffic passes through third-party networks and causes collateral damage.
How do law enforcement agencies track booter users? Booter services typically require account registration, payment (credit card or cryptocurrency), and IP logs. When law enforcement seizes booter servers, they obtain customer records, purchase history, and attack logs—directly linking accounts to attacks. Several prosecutions in the US have relied entirely on seized booter service logs.
Can a booter attack take down a major website? Major websites with cloud-based DDoS protection can typically absorb booter-scale attacks. Booter attacks are more effective against smaller organizations, gaming servers, and infrastructure without DDoS mitigation. The largest booter attacks reach 50–100 Gbps, which can saturate an unprotected network connection.
What happened to the booter services seized in Operation PowerOFF? Operation PowerOFF, coordinated by Europol and involving 15 countries, seized 49 booter domains in December 2022. The FBI simultaneously arrested multiple US-based booter operators. Several defendants were sentenced to federal prison. In 2023, a second wave of the operation seized additional infrastructure.
What is the difference between a booter and a botnet? A botnet is the underlying infrastructure of compromised devices that generates attack traffic. A booter is a service that sells access to a botnet (or amplification infrastructure) through a user-friendly interface. A booter operator may own the botnet, rent it, or use amplification servers rather than a traditional botnet.
How do I report a DDoS attack launched from a booter? Report to the FBI Internet Crime Complaint Center (IC3) at ic3.gov, Europol’s cybercrime reporting portal, or your national cybercrime reporting authority. Preserve server logs, NetFlow data, and any information about the attack’s source and timing before reporting.
Does BCP38 prevent booter attacks? BCP38 (Network Ingress Filtering, RFC 2827) prevents ISPs from forwarding packets with spoofed source IP addresses. This reduces amplification attacks, which rely on spoofed source IPs to redirect traffic to the victim. However, adoption remains incomplete globally, and booters that use actual botnet devices (not spoofed IPs) are not affected by BCP38.
How to Implement on Azion
Azion’s distributed network mitigates DDoS attacks at the network edge before they reach your origin infrastructure, including attacks generated by booter services:
- DDoS Protection provides always-on, automatic mitigation with no configuration required
- Network Layer Protection applies network-level rules against known attack patterns including UDP floods and amplification attacks
- WAF blocks HTTP-based booter attacks targeting your applications
- Edge Firewall enables IP reputation-based blocking and rate limiting rules
Related Resources
- What Is a DDoS Attack?
- What Is a DDoS Botnet?
- What Is DDoS Protection and Mitigation?
- Azion DDoS Protection
- DDoS Attack Types
Sources:
- Europol. “Operation PowerOFF.” Press Release, December 2022.
- FBI. “Booter Initiative.” Press Releases, 2018–2022.
- Europol. “DDoS-for-hire services taken down in international operation.”
- U.S. Department of Justice. “DDoS-for-hire service enforcement actions.”
- IETF. “Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing.” RFC 2827 (BCP38). 2000.
- US Department of Justice. “Computer Fraud and Abuse Act.” 18 U.S.C. § 1030.
- Hutchings, Alice and Clayton, Richard. “Configuring Zeus: A Case Study of Online Crime Target Selection and Knowledge Transmission.” IEEE, 2016. For less than fifty dollars, anyone with no technical knowledge can rent DDoS attack capacity capable of taking down small and medium business servers. These services — called booters or IP stressers — turned DDoS into a commodity product, eliminating the technical barrier that previously required dedicated infrastructure and offensive security expertise.
DDoS Booters (also called IP Stressers) are commercial platforms that offer DDoS attacks as a service (DDoS-as-a-Service, DaaS). They superficially present themselves as server “stress testing” tools — but in practice they are attack-for-hire services used to take down third-party targets without authorization.
How booters work
Most booters operate as conventional web platforms, with a control panel, subscription plans, and customer support. The operational flow of a purchase follows these steps:
- The user accesses the booter website — on the clearnet or dark web — and creates an account.
- Selects a plan according to the desired attack volume and duration.
- Enters the target: the victim’s IP address or domain.
- Selects the attack method: UDP Flood, SYN Flood, HTTP Flood, DNS amplification, and others.
- Launches the attack with a click.
The infrastructure executing the attack consists of three main elements: a rented botnet of compromised IoT devices and servers; UDP amplification reflectors (open DNS, NTP, and SSDP servers); and Command and Control (C&C) servers that coordinate the botnet devices.
Typical pricing structure
| Plan | Estimated price | Capacity | Duration |
|---|---|---|---|
| Basic | $5–15 | 1–10 Gbps | 60–300 seconds |
| Intermediate | $30–80/month | 10–50 Gbps | Unlimited per session |
| Premium | $100–500/month | 50–500 Gbps | Unlimited + support |
| Enterprise | $1,000+/month | 500 Gbps–1 Tbps | Unlimited + SLA |
Prices vary by platform, service reputation, and available attack vectors.
Attack vectors: UDP amplification, floods, and Layer 7
Volumetric UDP amplification and IP spoofing
The highest-impact vectors on DaaS platforms are reflection and amplification attacks based on UDP. The mechanism exploits two legitimate behaviors of network protocols:
Reflection: the attacker sends UDP packets with a spoofed source IP address (IP spoofing) to third-party servers, causing them to send the response directly to the victim — who never made the request.
Amplification: the exploited protocol generates responses much larger than the requests. A 60-byte query packet can generate a 4,000-byte response to the spoofed address, multiplying the volume of traffic hitting the victim.
The table below compares the main protocols exploited for volumetric amplification:
| Protocol | OSI Layer | Default port | Amplification factor | Exploitation mechanism |
|---|---|---|---|---|
| Memcached | L7 over UDP | 11211 | 10,000x–51,000x | stats request returns accumulated cache data; maximum documented amplification |
| CLDAP | L7 over UDP | 389 | 56x–70x | Connectionless LDAP search; response with directory data |
| DNS | L7 over UDP | 53 | 28x–70x | ANY or DNSKEY query with DNSSEC generates response with cryptographic signatures |
| NTP | L7 over UDP | 123 | 20x–556x | monlist command returns up to 600 IP addresses; disabled in modern versions |
| SSDP | L7 over UDP | 1900 | 30x | UPnP discovery on IoT devices returns XML device description |
| QUIC/UDP | L4 | 443 | Variable | Initial packet flood; server processes handshake before validating the client |
The February 2018 Memcached attack against GitHub, peaking at 1.35 Tbps, demonstrates the scale possible with massive amplification via a single protocol.
Layer 7 vectors: floods and protocol exhaustion
Beyond volumetric attacks, DaaS platforms offer Layer 7 vectors that consume application resources instead of network bandwidth:
HTTP Flood: sends GET or POST requests in massive volume against application endpoints. Each request is syntactically valid, making it difficult to distinguish from legitimate traffic by network devices.
Slowloris and R.U.D.Y.: hold HTTP connections open indefinitely with extremely slow data transmission rates. They exhaust the server’s connection pool without generating network volume detectable by volumetric alerts.
HTTP/2 Rapid Reset: exploits HTTP/2’s stream cancellation mechanism (RST_STREAM frame). The attacker opens and cancels streams in rapid sequence, forcing the server to continuously allocate and release resources. In August 2023, this vector was used in record attacks of 201 million requests per second against Google infrastructure.
TLS/SSL handshake exhaustion: forces the server to process TLS handshakes en masse, exploiting the computational asymmetry where the server consumes approximately 15 times more CPU than the client per established session.
DaaS vector comparison table
| Vector | Layer | Network volume | Resource exhausted | Detectable by volume? |
|---|---|---|---|---|
| UDP Flood | L3 | Very high | Bandwidth | Yes |
| SYN Flood | L4 | Medium | TCP state table | Yes |
| DNS/NTP/Memcached Amplification | L3–L7 | Very high | Victim bandwidth | Yes |
| HTTP Flood | L7 | Low–medium | CPU, application threads | No (normal volume) |
| Slowloris / R.U.D.Y. | L7 | Very low | HTTP connection pool | No |
| HTTP/2 Rapid Reset | L7 | Low | HTTP/2 server CPU | No |
| TLS Exhaustion | L7 | Low | Server cryptographic CPU | No |
What powers booters: IoT botnets
Booter attack capacity comes primarily from botnets composed of compromised IoT devices — home routers, IP cameras, DVRs, and smart TVs — running malware like Mirai and its variants. The compromise cycle occurs in six steps:
- An IoT device with default credentials (such as
admin/admin) is exposed on the public internet. - An automated scanner identifies the device and tests known credentials via Telnet or SSH.
- Malware (Mirai or a variant) is installed and persists on the device.
- The device is registered in the botnet and awaits commands from the C&C server.
- When a booter customer contracts an attack, the C&C sends the flood order to the bots.
- The device owner rarely notices — the extra CPU usage and bandwidth consumed go undetected in home environments.
Mirai’s source code, which leaked in 2016, spawned hundreds of variants (Satori, Hajime, Mozi) collectively infecting tens of millions of devices. A single scanning campaign can recruit hundreds of thousands of bots within hours.
Legal implications
Contracting or executing DDoS attacks through booters constitutes a crime in virtually all jurisdictions. Below is the legal framework in the main jurisdictions:
United States
The Computer Fraud and Abuse Act (CFAA) criminalizes DDoS attacks with penalties of up to 10 years imprisonment. Operation Power Off (2018), coordinated by the FBI and Europol, took down 15 booters and resulted in 3 arrests. In 2022, a second phase of the operation took down more than 48 booter domains.
European Union
Directive 2013/40/EU on attacks against information systems provides for 2 to 5 years imprisonment in member states, with aggravated penalties for use of automated attack tools and for the scale of damage caused.
Brazil
Under Brazilian law, DDoS attacks via booters primarily incur two criminal types that may occur in concurrent offenses:
Article 266 of the Penal Code (interruption or disturbance of telematic or information service of public utility): the primary type for launching an attack that interrupts or disturbs informatic or telematic services, with penalties of detention of 1 to 3 years, and a fine.
Article 154-A of the Penal Code (invasion of computing device): applies specifically to the botnet formation phase — installing malware on IoT devices and servers. When the same agent recruits bots and uses the botnet to launch the attack, concurrent offenses apply, with sentences combined.
Important: hiring a booter and pointing it at a target — even calling it “stress testing” — constitutes a crime if done without explicit documented authorization from the system owner.
Why “IP Stresser” is a euphemism
Booters frequently present themselves as legitimate “server stress testing” tools. This cover has obvious technical and legal limitations:
- Legitimate load testing services (like k6, Gatling, and loader.io) generate realistic HTTP traffic with simulated user behavior — not 100 Gbps UDP floods.
- Real stress tests are documented, with written consent from the system owner, conducted during planned maintenance windows.
- Booters do not verify whether the user has authorization over the target IP — an essential condition for any legitimate test.
- Most booters operate via cryptocurrency and anonymization services to hinder tracking and attribution.
Traffic characteristics generated by booters
Traffic originating from DaaS platforms exhibits identifiable patterns that enable detection and blocking before it reaches origin servers:
| Characteristic | Typical booter pattern |
|---|---|
| Source IP distribution | Concentrated in hosting ranges and countries with permissive regulation |
| User-Agent (L7) | Repeated patterns or absence of typical real browser headers |
| Source ASN | Concentrated in abusive or bullet-proof hosting Autonomous Systems |
| Packet timing | Regular, mechanical, non-human — constant intervals between sends |
| TLS fingerprint (JA3/JA4) | Hashes of known attack tools — LOIC, HOIC, UFONet, Python scripts |
| IP reputation | Ranges present in threat intelligence feeds and abuse lists |
| Payload diversity | UDP with random or fixed payload; HTTP without secondary resources |
Defense techniques against DaaS traffic
JA3 and JA4 TLS fingerprinting at the edge
Each client’s TLS handshake leaves a “fingerprint” based on the sequence of cipher suites, TLS extensions, and version parameters. The JA3 hash (and its successor JA4) of attack tools used by booters — LOIC, HOIC, Python scripts with requests or socket — differs consistently from hashes produced by legitimate browsers like Chrome, Firefox, and Safari.
A WAF or edge protection system with JA3/JA4 support can block requests with attack tool fingerprints before even analyzing HTTP content, eliminating the vector regardless of IP rotation. This is especially effective against sophisticated booters that use residential proxies to vary addresses.
Distributed edge scrubbing versus centralized scrubbing center
Centralized scrubbing architectures redirect all traffic to a single geographic point for inspection before forwarding to the destination. This model has two critical limitations against modern DaaS attacks:
The first is hairpin latency: legitimate user traffic may be diverted to a scrubbing center thousands of miles away, adding 80–150ms — perceptible degradation for real-time applications.
The second is L7 vector limitation: traditional scrubbing centers operate at L3/L4. Attacks like HTTP/2 Rapid Reset, Slowloris, and TLS exhaustion use syntactically valid connections that pass network inspection without being blocked.
Distributed edge scrubbing solves both problems: inspection occurs at each data center in the global network, close to the traffic source. Attack traffic from Europe is filtered at European data centers; APAC traffic at Asian data centers. Legitimate users experience no route detour. Over HTTPS traffic, TLS termination at the edge enables real-time Layer 7 inspection — identifying DaaS patterns, non-human behavior, and attack tool fingerprints — before any packet reaches the origin server.
Dynamic rate limiting by ASN and behavior
When attack traffic converges from specific ASNs (hosting networks that host booter infrastructure), dynamic rate limiting by ASN blocks the attack more efficiently than individual IP blocking. Booters continuously rotate IPs; the ASNs hosting their infrastructure change far less frequently.
Behavior-based rate limiting complements ASN blocking: connections that open but don’t complete the HTTP handshake, requests without secondary resources (CSS, JavaScript, images), mechanical timing patterns, and absence of session cookies are behavioral signals of automation that enable selective discard without impacting real users.
Threat intelligence and IP reputation
Continuously updated reputation lists identify IP ranges from booter infrastructure, IoT botnets, and abusive hosting services. Blocking or rate-limiting requests from these ranges significantly reduces attack impact, even when the booter attempts to vary attacking IPs within the same ASN range.
Common mistakes and solutions
Mistake: Believing booters only affect large enterprises. Solution: Low-cost booters ($5–20) are accessible to anyone and can take down SMB servers, independent games, streamers, and competitors in competitive markets. No organization is too small to be a target — and the low attack cost further lowers the attacker’s motivation threshold.
Mistake: Blocking individual IPs after the attack starts. Solution: Booters continuously rotate IPs. Reactive IP blocking is ineffective and consumes operational resources. Use behavioral detection and TLS fingerprinting (JA3/JA4), which work regardless of source IP.
Mistake: Relying solely on centralized scrubbing for DaaS protection. Solution: Centralized scrubbing is effective against volumetric L3/L4 attacks, but doesn’t detect L7 vectors like HTTP/2 Rapid Reset, Slowloris, and TLS exhaustion. The combination of distributed edge scrubbing with TLS termination and L7 inspection covers all DaaS vectors.
Mistake: Not reporting attacks to relevant authorities. Solution: DDoS attacks are crimes. Reporting contributes to investigations that result in booter takedowns and criminal proceedings against operators.
Frequently asked questions
Are booters illegal even for “testing my own server”? If you’re genuinely testing your own infrastructure, it’s legal — provided the server is yours and you have documented authorization over all involved infrastructure, including upstream providers. In practice, booters don’t verify target IP ownership. Using a booter against any target that isn’t explicitly yours constitutes a crime under the CFAA in the US, the EU directive, and equivalent laws globally.
Why is it so difficult to shut down booters? Many operate on the dark web or in jurisdictions with weak law enforcement. They use cryptocurrency for payments, bullet-proof hosting services, and anonymously registered domains. Successful takedowns like Operation Power Off require international cooperation between agencies from multiple countries — a process that can take months of coordinated investigation. When booters are used for extortion — threatening attacks in exchange for payment — they also constitute the Ransom DDoS vector.
What was Operation Power Off? Operation Power Off (2018), coordinated by the FBI, Europol, and international partners, took down 15 booters and resulted in 3 arrests. In 2022, a second phase took down more than 48 booter domains and identified hundreds of users.
Do IoT devices still power booters in 2026? Yes. Estimates suggest more than 15 billion IoT devices are connected to the internet, many with default credentials and no regular security updates. Mirai malware and its variants (Satori, Mozi, Hajime) continue to be the primary bot source for booters, with new scanning campaigns emerging continuously.
Is HTTP/2 Rapid Reset offered by booters? Yes. Since the record attacks of 2023, tools exploiting HTTP/2 Rapid Reset have been offered on premium DaaS platforms. The vector is especially valuable for booters because it generates massive impact (measured in requests per second) with relatively low network volume, making it difficult to detect by volumetric monitoring systems.
How do you distinguish a legitimate load test from a booter? Legitimate load tests are documented, have written consent from the system owner, generate HTTP traffic with simulated user behavior (cookies, secondary resources, variable timing), and use platforms like k6, Gatling, or JMeter. Booters: no ownership verification, generate UDP/TCP/HTTP floods at disproportionate volume, and their customers anonymize payments.
How to implement on Azion
Azion protects against attacks originating from booters and DaaS infrastructure with a distributed edge scrubbing architecture:
- Bot Manager with JA3/JA4 TLS fingerprinting: Identifies and blocks attack tools used by booters — LOIC, HOIC, Python scripts, UFONet, and custom UDP tools — through TLS signatures (JA3/JA4) and Layer 7 behavioral analysis, without relying on static IP reputation. Blocking occurs at the edge before any request reaches the origin server.
- Distributed edge scrubbing with TLS termination: Traffic is inspected at each of Azion’s 100+ data centers, close to the attack source, via global Anycast network. TLS termination at the edge enables real-time Layer 7 inspection, detecting HTTP/2 Rapid Reset, Slowloris, R.U.D.Y., and TLS handshake exhaustion — vectors invisible to centralized L3/L4 scrubbing.
- Always-on DDoS Protection: Automatically absorbs volumetric floods (UDP, SYN, ICMP, DNS/NTP/Memcached amplification) at Azion’s data centers, without manual activation, BGP redirection, or route adjustment during the attack.
- Network Shield with dynamic rate limiting: Filters L3/L4 patterns characteristic of booters, including UDP Floods with random payloads and SYN Floods with spoofed IPs, applying dynamic rate limiting by ASN and connection behavior.
Learn more in the Azion DDoS Protection documentation.