Skip to content

Assessing the Aftermath: The Effects of a Global Takedown Against DDoS-for-hire Services#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Adjacent pick 13–15 August 2025

Recording

Anh V. Vu et al., University of Cambridge; University of Edinburgh; University of Strathclyde; University of Illinois Chicago — Adjacent

Play the recording: Assessing the Aftermath: The Effects of a Global Takedown Against DDoS-for-hire Services

  • Why: A rare quantitative, multi-year measurement of whether law-enforcement disruption actually works against the DDoS-for-hire ecosystem — useful context for anyone evaluating DDoS threat trends rather than just technical mitigation.
  • What: An assessment of the largest booter takedown effort to date (since December 2022), finding over half of seized sites returned within a day, traffic to re-emerged domains dropped 80–90%, and the first takedown wave cut global DDoS volume 20–40% (with a significant effect specifically on UDP-based attacks) — but the overall market proved resilient, with effects lasting at most ~6 weeks. (from abstract only)
  • How: Combines web traffic data, ground-truth visits to seized sites, millions of DDoS attack records, and underground-forum/Telegram chat analysis. (from abstract only)
  • Where applicable: General threat-intelligence context for DDoS trend forecasting; policy-relevant more than technically actionable for network defenders directly.