A DDoS attack that knocks a small site offline for an afternoon costs about the same as a large pizza. That’s not a rhetorical flourish — it’s a price list. The booter services that sell these attacks advertise monthly plans, and the entry tier has hovered around $10 to $20 for years. Webstresser, the biggest of them before it was taken down, started subscriptions at $15 a month. For that you got 136,000 other customers’ worth of shared infrastructure and, collectively, the platform launched close to four million attacks.
The cheapness is the whole story, and everyone tells it wrong. The usual framing is “attacks have gotten so cheap,” as if the price fell because the technology got efficient. That’s backwards. The price is low because the person paying $10 isn’t paying for the attack. They’re paying for the interface. The attack itself — the bandwidth, the firepower, the machines — is subsidized by everyone else on the internet, most of whom have no idea they’re chipping in.
What $10 actually buys
Let’s be precise about what a “booter” or “stresser” is, because the industry has spent a decade hiding behind a euphemism. The pitch is that these are legitimate “stress testing” services: you point one at your own server to see how it holds up under load. A few of them even make you check a box saying you own the target. Nobody believes this, including the operators. When the FBI seized 48 booter domains in December 2022 and charged six people, and then took down 13 more the following May, the charging documents were not about stress testing. Webstresser’s takedown in 2018 — Operation Power OFF, a coordinated sweep across more than a dozen countries — wasn’t either.
So what you rent for $10 is a web dashboard. You type in an IP or a hostname, pick a duration and an “attack method” from a dropdown, and click go. The dashboard is the entire product. Everything behind it — the thing that actually generates the flood — is borrowed.
That’s the part worth understanding, because it explains the price.
The firepower is free, and that’s by design
Here’s the mechanism that makes a $10 attack possible: amplification.
The idea is old and embarrassingly simple. Certain internet services running over UDP will answer a small request with a large response. If you can send that small request but lie about where it came from — put the victim’s IP in the “from” field — then the service dutifully mails the big response to the victim. You spend a little bandwidth; the victim absorbs a lot. You’ve turned a public server into an unwitting cannon pointed at someone else.
The amplification factors are absurd. DNS resolvers give you maybe 28 to 54 times your input. NTP servers, with the right query, hundreds of times. And then there’s memcached — a caching system that was never supposed to face the public internet at all, listening on UDP port 11211. A memcached amplification can return up to 51,200 times what you sent it. A 15-byte request comes back as a 750-kilobyte response. That’s not a typo. Fifteen bytes in, three-quarters of a megabyte out, aimed wherever you claimed to be from.
In February 2018 this stopped being theoretical. GitHub was hit with 1.35 terabits per second of traffic — at the time the largest DDoS ever recorded — generated almost entirely through memcached reflection. The attackers didn’t own a 1.35 Tbps pipe. Nobody does. They sent a modest stream of tiny spoofed requests to a pile of exposed memcached servers, and those servers, running on other people’s infrastructure, produced the terabits. Days later someone broke the record again at 1.7 Tbps using the same trick.
Every one of those amplifying servers was misconfigured by somebody who wasn’t attacking anyone. They left a caching daemon exposed, or ran an open DNS resolver, or never patched an NTP server, and in doing so they donated a slice of firepower to whoever comes asking. The booter operator didn’t build that capacity. They just enumerated it and put a dropdown in front of it.
The one line of defense nobody deploys
The whole trick depends on lying about your source address. Send a packet that claims to come from the victim, and the amplifier replies to the victim. If that lie were caught, reflection attacks would collapse overnight.
And we’ve known how to catch it since 2000. It’s called BCP 38 — RFC 2827, “Network Ingress Filtering.” The idea is trivial: a network should check that packets leaving it actually originate from addresses inside it, and drop the ones that don’t. If every network filtered its own outbound traffic this way, you couldn’t spoof the victim’s address in the first place. No spoofing, no reflection.
Twenty-five years later, adoption is still partial. Filtering your own outbound spoofed traffic costs you a little effort and configuration, and the benefit accrues entirely to other people — the strangers who won’t get attacked through your network. That’s a textbook tragedy of the commons, and it plays out exactly as the theory predicts: the individually rational move is to not bother, so a large fraction of networks don’t. Spoofed packets keep flowing, because stopping them was always somebody else’s problem.
There’s a second free resource too: botnets. Compromised routers, cameras, DVRs — the Mirai worm and its endless descendants recruit hundreds of thousands of cheap IoT devices whose owners will never notice. That’s more borrowed capacity, more externalized cost. The device owner pays the electricity and the bandwidth; the attacker points it.
Who’s actually paying
So the $10 is real, but it’s not the price of the attack. It’s the price of the convenience. The genuine cost of a DDoS — the bandwidth, the amplifying servers, the un-filtered networks that let spoofed packets through, the hijacked devices doing the sending — is paid in tiny, invisible increments by everyone who runs a piece of the internet slightly wrong. The booter is a business built entirely on costs it doesn’t bear.
This is why I think the takedowns, satisfying as they are, treat the wrong disease. Seizing booter domains and arresting operators addresses the supply of interfaces. It does nothing about the supply of firepower, which is the misconfiguration sitting on millions of servers and the filtering that millions of networks decline to do. Arrest every booter operator today and the raw material — open amplifiers, spoofable networks, herds of vulnerable IoT — is all still there for the next one, who will have a new dashboard up within a week. The 2022 and 2023 seizures were real wins, and booters kept selling.
The price of an attack is a mirror. It tells you exactly how much of the cost the internet has agreed to absorb on the attacker’s behalf. As long as source address validation is optional and amplifiers stay open to the public, that number stays around ten dollars — not because attacks are cheap to mount, but because almost nobody who pays for them is the one holding the bill.