Booting the booters: evaluating the effects of police interventions in the market for denial-of-service attacks

Ben Collier, Daniel R. Thomas, Richard Clayton, Alice Hutchings

Research output: Chapter in Book/Report/Conference proceedingConference contribution book

22 Citations (Scopus)
101 Downloads (Pure)


Illegal booter services offer denial of service (DoS) attacks for a fee of a few tens of dollars a month. Internationally, police have implemented a range of different types of intervention aimed at those using and offering booter services, including arrests and website takedown. In order to measure the impact of these interventions we look at the usage reports that booters themselves provide and at measurements of reflected UDP DoS attacks, leveraging a five year measurement dataset that has been statistically demonstrated to have very high coverage. We analysed time series data (using a negative binomial regression model) to show that several interventions have had a statistically significant impact on the number of attacks. We show that, while there is no consistent effect of highly-publicised court cases, takedowns of individual booters precede significant, but short-lived, reductions in recorded attack numbers. However, more wide-ranging disruptions have much longer effects. The closure of HackForums' booter market reduced attacks for 13 weeks globally (and for longer in particular countries) and the FBI's coordinated operation in December 2018, which involved both takedowns and arrests, reduced attacks by a third for at least 10 weeks and resulted in lasting change to the structure of the booter market.
Original languageEnglish
Title of host publicationIMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference
Place of PublicationNew York, NY.
Number of pages15
ISBN (Electronic)9781450369480
Publication statusPublished - 21 Oct 2019
EventInternet Measurement Conference - Amsterdam, Netherlands
Duration: 21 Oct 201923 Oct 2019


ConferenceInternet Measurement Conference
Internet address


  • booter
  • cybercrime
  • DDoS
  • denial of service attacks
  • police interventions
  • stresser
  • UDP-reflection


Dive into the research topics of 'Booting the booters: evaluating the effects of police interventions in the market for denial-of-service attacks'. Together they form a unique fingerprint.

Cite this