More Amazon than Mafia: analysing a DDoS stresser service as organised cybercrime

The internet mafia trope has shaped our knowledge about organised crime groups online, yet the evidence is largely speculative and the logic often flawed. This paper adds to current knowledge by exploring the development, operation and demise of an online criminal group as a case study. In this article we analyse a DDoS (Distributed Denial of Service) stresser (also known as booter) which sells its services online to enable offenders to launch attacks. Using Social Network Analysis to explore the service operations and payment systems, our findings show a central business model that is similar to legitimate e-commerce websites in the way product, price and costumers are differentiated. It also illustrates that its organisation is distributed and not hierarchical and the overall income yield is comparatively low, requiring further organisational activity to make it pay. Finally, we show that the users of the service (mainly offenders) are not only a mixed group of actors, but that it is also possible to discriminate between different levels of seriousness of offending according to the particular service they purchased.