Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services

TL;DR

This study evaluates a large-scale, multi-wave global intervention against DDoS-for-hire services, revealing short-term reductions in attack volume and insights into the resilience and re-emergence of these illicit markets.

Contribution

It provides the most extensive analysis to date of takedown efforts against DDoS-for-hire services, combining diverse datasets to assess their immediate and short-term impacts.

Findings

First wave reduced DDoS attack volume by 20-40%.

Re-emerged sites struggled to attract visitors, with 80-90% traffic reduction.

Overall impact lasted only about six weeks, indicating high resilience of the illicit market.

Abstract

Law enforcement and private-sector partners have in recent years conducted various interventions to disrupt the DDoS-for-hire market. Drawing on multiple quantitative datasets, including web traffic and ground-truth visits to seized websites, millions of DDoS attack records from academic, industry, and self-reported statistics, along with chats on underground forums and Telegram channels, we assess the effects of an ongoing global intervention against DDoS-for-hire services since December 2022. This is the most extensive booter takedown to date conducted, combining targeting infrastructure with digital influence tactics in a concerted effort by law enforcement across several countries with two waves of website takedowns and the use of deceptive domains. We found over half of the seized sites in the first wave returned within a median of one day, while all booters seized in the second wave returned within a median of two days. Re-emerged booter domains, despite closely resembling old ones, struggled to attract visitors (80-90% traffic reduction). While the first wave cut the global DDoS attack volume by 20-40% with a statistically significant effect specifically on UDP-based DDoS attacks (commonly attributed to booters), the impact of the second wave appeared minimal. Underground discussions indicated a cumulative impact, leading to changes in user perceptions of safety and causing some operators to leave the market. Despite the extensive intervention efforts, all DDoS datasets consistently suggest that the illicit market is fairly resilient, with an overall short-lived effect on the global DDoS attack volume lasting for at most only around six weeks.