What is an IP stresser? Booters and the law

02How does the booter market work?

Booter services are sold like any other subscription. A customer picks a plan, enters a target address, chooses an attack type and a duration, and pays, often in cryptocurrency. The appeal to offenders is that no skill is required: the service owns the attack infrastructure, so the buyer only points and clicks.

The traffic itself usually comes from one of two places. Some services drive attacks from a botnet of compromised devices. Others rely on reflection and amplification, sending small spoofed requests to misconfigured public servers, such as old NTP or exposed memcached servers, so that much larger replies land on the victim, the technique behind amplification attacks. The US Department of Justice has described the 'stresser' label as a pretence, noting that communications between operators and customers make clear the customer is not attacking their own systems.

Price is not a measure of harm. Europol reported in May 2025 that six services dismantled in Poland sold attacks 'for as little as EUR 10', while the same platforms had been used against schools, government services, businesses and gaming platforms. The UK's National Crime Agency describes the result plainly: the perceived anonymity and ease of use have made DDoS 'an attractive entry-level crime, allowing individuals with little technical ability to commit cyber offences with ease'.

03Where testing ends and the offence begins

A stresser is lawful only against infrastructure you own or are explicitly authorised to test. Aiming a stresser at anyone else's system is unauthorised impairment of a computer, which is a criminal offence across the US, UK, EU and beyond. The terms of service on a booter's home page do not change that; they protect the operator's story, not the customer.

The Netherlands, where this explainer's publisher is based, is a representative example. Article 138b of the Dutch Criminal Code (Wetboek van Strafrecht) punishes anyone who 'intentionally and unlawfully' obstructs access to or use of an automated system by offering or sending data to it, with up to two years' imprisonment or a fourth-category fine. The maximum rises to three years where a significant number of compromised systems is used or the aim is unlawful gain, and to five years where the attack causes serious damage or targets vital infrastructure.

The penalties, the botnet aggravating factors and the equivalents in other countries are covered in detail on the dedicated page about whether DDoS is illegal. Defending a system you run is never the offence: filtering hostile traffic or running DDoS mitigation in front of your own service is entirely lawful.

04Operation PowerOFF: the takedowns

The takedowns began before the operation had its current shape: the Dutch police and the NCA led the 2018 Webstresser action under the name Power Off, and the FBI's December 2018 seizures followed. Since then Operation PowerOFF has grown into a recurring, multi-country campaign with Europol at its centre, with several waves timed for December, ahead of the attacks that spike over the holidays. The dates and figures below come from the agencies' own announcements.

05Decoy sites, adverts and the deterrence evidence

Enforcement targets demand as well as supply. In March 2023 the UK's National Crime Agency revealed it had been running its own fake DDoS-for-hire sites. As the agency's director general put it in a later lecture, the NCA 'set up our own DDOS sites, purporting to be criminal, to lure in several thousand cyber criminals before explaining to them that they themselves had been scammed'. The stated aim was not only to collect data but to sow distrust in the market. Users in the UK were to be contacted by the NCA or police, and information on users abroad was passed to international law enforcement.

Agencies also buy search adverts aimed at people looking for attack tools. Academic measurement supports the approach: the study 'Booting the Booters' found that an NCA search-advert campaign warning young UK users appears to have halted the rise in attacks on UK addresses for as long as it ran, that the closure of one forum's booter market reduced attacks for about 13 weeks, and that the December 2018 infrastructure takedown 'reduced attacks by a third for at least 10 weeks'. Takedowns of single services, by contrast, preceded only short-lived dips.

The lesson for a defender is that the market is pursued at every level. The lesson for anyone tempted to rent an attack is that the services are monitored, the records are kept, and the consequences reach customers, not only operators.

06How do I tell a lawful load test from a booter?

Legitimate load and stress testing is a normal part of running a service. The difference from an attack is authorisation and ownership, not technique. A lawful test targets a system you control, has written permission on file, respects the hosting provider's testing policy, and uses purpose-built tooling against a staging or controlled environment. A booter offers to attack an address you type in, asks no proof that you own it, and hides behind a disclaimer.

• Write down the scope first: target hostnames and addresses, the traffic profile, peak rate, start and end time, and the result that counts as a pass
• Get that scope signed by whoever owns the target, and by the hosting or protection provider where their network carries the traffic
• Check the provider's testing rules before you book anything; AWS, for example, only permits DDoS simulations through pre-approved test partners, against Shield Advanced-protected resources in your own account, capped at 20 Gbit/s
• Expect a genuine testing firm to ask for proof of ownership and a named contact who can stop the test at once; a service that never asks is a booter
• Publish the test window and source addresses to your own operations team, so the traffic is not mistaken for an incident