A secondary school in the middle of GCSE season, a regional ecommerce operator running a bank holiday promotion, a managed service provider with forty tenants sitting behind one prefix: all three can be pushed offline for less than the cost of a takeaway, because DDoS for hire in the UK is sold as a tiered monthly subscription with set attack durations and concurrent slots. The attacks are rarely large. That is exactly what makes them effective, because most defensive buying decisions in British SMEs are sized against headline terabit figures rather than against a few gigabits arriving in 40-second bursts, nine times before lunch.

This piece maps the market, states the UK legal position plainly, then turns to the part that decides whether you stay up: what a rented attack looks like in your own flow data, and how to contract protection against that shape.

What DDoS for hire actually is, and how the UK market sells it

The products are usually called booters or stressers. Same infrastructure, two names, often wrapped in language about “network stress testing”and terms of service claiming the customer must own the target. Nobody checks. Pricing is tiered by attack length, from short free-tier bursts of under a minute up to the half-hour-plus durations advertised on top plans, by how many attacks you can run at once, and by which “methods”are unlocked. Payment is typically cryptocurrency or a card processor that lasts a few weeks before it is dropped.

Where the capacity really comes from

Three sources, blended. Reflection and amplification off badly configured internet services: open DNS resolvers, NTP servers answering monlist, CLDAP endpoints on exposed domain controllers, and the occasional unauthenticated memcached instance. Rented virtual private servers in jurisdictions with relaxed abuse handling, used to spray spoofed requests. And compromised consumer hardware, which still means home routers, DVRs and IP cameras running firmware nobody will ever patch.

Amplification is the economics of the whole market. A seller pushes a few megabits of spoofed queries at thousands of open resolvers; your transit link receives multiple gigabits of responses. The attacker rents bandwidth once and bills you for the consequences.

Why advertised capacity is marketing

Booter panels advertise peak figures the way second-hand car adverts advertise top speed. Sellers resell each other’s infrastructure, quote a theoretical maximum achieved once on a quiet night, and routinely under-deliver on cheap tiers because the amplifier lists are shared across hundreds of concurrent customers. Defenders should treat those numbers as unverified sales copy, in exactly the way they should treat the Tbps claims made by mitigation vendors on the other side of the trade.

Who actually buys it

Not organised extortion crews, mostly. Gaming grudges account for a large share. Then exam-season attacks on school networks and remote learning platforms, competitor sabotage aimed at ecommerce sites during peak trading, and disputes with former suppliers, former employees or customers who lost an argument with your support desk. The booter economy is priced for grudges, not for taking down clearing banks.

The UK legal position: using, buying and supplying

Launching a denial-of-service attack against a system you have no authority over falls under section 3 of the Computer Misuse Act 1990, unauthorised acts with intent to impair the operation of a computer, which carries a maximum sentence of ten years’ imprisonment. Section 3A covers making, supplying or obtaining articles for use in computer misuse offences. That second limb is the one organisations misread.

Buying is not a grey area. Registering an account on a booter site and paying for a subscription creates its own evidence trail, and UK enforcement has gone after customers rather than only operators. The National Crime Agency has run decoy booter sites designed to capture the details of would-be purchasers, publicised in 2023, and the NCA took control of the DigitalStress service in July 2024 as part of Operation PowerOFF, the long-running international effort against stresser infrastructure. Takedowns work in the sense that they remove named brands and their customer databases. New panels reappear under new names within weeks, which is why enforcement has shifted towards deterrence aimed at buyers. The sentencing picture is set out further in our explainer on how UK courts have treated DDoS offences.

When the purchase comes from inside your own estate

Here is the scenario competitors skip entirely. A booter purchase linked to your IP range, your guest Wi-Fi, your staff Office 365 account or a pupil’s school device turns a network incident into an HR matter, a safeguarding referral and an acceptable use policy problem at the same time. Schools and colleges in particular should assume that at least some attacks on their own infrastructure originate with pupils, and that the appropriate response involves police and safeguarding leads rather than only the IT team. Make sure your acceptable use policy names stresser services explicitly, and that your incident plan says who contacts the police when the suspect is a fourteen-year-old on roll.

What a hired attack really looks like at your edge

The characteristic profile: volumetric reflection in the low single-digit gigabits, in bursts of roughly 30 seconds to five minutes, repeated across hours. Not one sustained flood. Dozens of short hits, sometimes alternating vectors, sometimes alternating targets across your prefix.

Vectors sold as one-click presets include DNS, NTP, CLDAP and memcached reflection, TCP SYN and ACK floods, and layer 7 HTTP request floods driven through rented residential or data centre proxy pools. Authoritative DNS query floods deserve separate mention: they are cheap to buy, trivially effective, and devastating if your nameservers sit outside whatever mitigation contract you signed.

Reading your own evidence

Short bursts hide inside averaged monitoring. A 4 Gbps burst lasting 30 seconds, averaged across a five-minute SNMP polling interval, shows up as roughly 400 Mbps, which is to say as nothing at all. Sampled NetFlow or sFlow at 1-in-1000 compounds the problem on brief events. If your graphs look calm while your phones are ringing, suspect the measurement before you dismiss the attack.

What to look at instead, in order: packets per second plotted alongside bits per second, because reflection produces a pps spike disproportionate to legitimate request volume; the source port distribution, where a narrow set clustered on 53, 123, 389 or 11211 is a reflection signature rather than organic traffic; per-destination-IP breakdowns, since booter presets often cycle targets inside a /24; and web logs, where layer 7 floods leave repeating user-agent and path patterns. Our walkthrough on telling a DDoS apart from an ordinary outage covers the triage sequence in more detail.

Why cheap attacks still knock over well-defended sites

Origin IP leakage

Volume is seldom the reason a proxy-protected site falls over to a cheap, low-tier subscription. Leakage is. Historical DNS records held by passive DNS services, certificate transparency logs listing every hostname you ever requested a certificate for, SPF and DKIM headers on your outbound mail, a forgotten staging. Or vpn. Subdomain still pointing at the origin, and the direct-to-origin API host your mobile app talks to. Any one of those hands an attacker an address that bypasses your edge entirely. No amount of scrubbing capacity defends a route the traffic never takes.

Fix it the boring way: rotate origin addresses after you deploy a proxy, firewall the origin to accept only your provider’s published ranges, audit certificate transparency entries for your own domains, and stop issuing certificates for hostnames that reveal infrastructure.

Short bursts versus on-demand mitigation

On-demand models assume a flood long enough to justify switching traffic. Detection takes a minute or two, the customer or provider decides to divert, BGP announcements propagate, a GRE tunnel or cross-connect carries clean traffic back, and an engineer joins a bridge. By then a 90-second burst finished four minutes ago and the next one has started. Against rented attacks, detection-to-mitigation time beats scrubbing headline figures every time, and on-demand diversion is usually the wrong purchase. Always-on costs more and adds some latency. It also mitigates burst eleven as reliably as burst one.

The surfaces nobody owns

Authoritative DNS is the most commonly uncovered surface in UK mitigation contracts, and the one booter presets attack most happily. Ask explicitly: are my nameservers inside the contract, who is the DNS operator as distinct from the registrar, and what happens to resolution if they are flooded? Then do the same for VPN and remote access concentrators, SFTP and EDI endpoints, SIP trunks, and any third-party SaaS integration your checkout depends on. A web application firewall in front of the website does nothing for the IPsec concentrator your branch offices use.

Application-layer floods that look like real users

Consider a flood of tens of thousands of requests per second aimed at site search, login, basket or on-the-fly PDF generation, arriving from a rotating proxy pool with plausible user agents. Bandwidth stays unremarkable, so bandwidth-based alerting never fires, while application workers and database connections exhaust in minutes. The asymmetry is the point: a search query costs the attacker almost nothing and costs you a database scan. Rate-limit by endpoint cost rather than by a single global threshold, and read our breakdown of the gaps in application layer DDoS protection before you assume your WAF has this covered.

Sizing and buying protection against rented attacks

Match the deployment model to the surface. Reverse proxy for web and API traffic; BGP-based scrubbing when you need whole-prefix coverage or non-HTTP services protected; hosting-level filtering treated as a floor, not a plan. Most SMEs need the first, some need both, and almost nobody needs the headline tier they are shown first.

Then pin down what “managed”actually buys. Onboarding and initial rule tuning, always-on baselining, named escalation contacts, defined time-to-mitigate, and the answer to one question: is a human on the provider’s side empowered to change layer 7 policy at 03:00 without your written sign-off? If not, you have bought monitoring, not management. Check also what the time-to-mitigate clause starts measuring, because a clock that starts when you raise a ticket is a very different commitment from one that starts at detection.

Trace the resale chain. Many UK offers advertised as DDoS protected are reselling someone else’s scrubbing network. Establish whose network it is, which points of presence serve UK traffic (London only, or London plus Manchester and Amsterdam), who holds the upstream capacity contract, and what evidence the provider will give you beyond a sales deck: sample attack reports, vector breakdowns, previous incident timelines.

Build the business case from your own downtime cost, not from attack size. Revenue or billable hours per hour, multiplied by a realistic three-hour impaired window rather than a theoretical full outage, then compared against annual always-on spend with DNS and API surfaces inside the priced scope. For most UK mid-market buyers the arithmetic settles the argument quickly, and our guide to what DDoS protection really costs in the UK sets out the pricing models you will meet.

If you are being hit now: the first hour and the reporting trail

1. Confirm it is an attack. Check pps alongside bps, source port spread and whether unrelated services on the same prefix are also degraded. Expired certificates and failed deployments look like attacks for the first ten minutes.
2. Preserve evidence before you mitigate. Flow record exports, log extracts with timestamps in a stated timezone, firewall counters and any provider attack report. You will need these for insurance, for police reporting and for the post-incident argument with your supplier.
3. Escalate in a fixed order: mitigation provider first, then hosting or transit provider, then DNS provider, then internal communications with a short holding statement that commits to nothing about cause.
4. Treat any ransom demand as an intelligence item, not a decision. Paying marks you as a payer and invites repeat targeting, often from a different buyer who bought the same list. Log the demand verbatim, keep the wallet address, and report it.
5. Report it. Fraud and cyber crime against UK organisations goes to Action Fraud, with the NCA handling serious and organised cases. Reporting is also how enforcement builds the customer lists that make takedowns like DigitalStress worth running.

Afterwards, change the things that actually reduce repeat success: origin addresses rotated and locked to provider ranges, nameservers brought inside a protected service, per-endpoint rate limits on expensive application paths, and an escalation matrix with names and mobile numbers rather than a shared inbox. Repeat targeting is the norm rather than the exception, as the finding that half of targeted firms get hit again suggests.

Frequently Asked Questions

Is DDoS for hire illegal in the UK?

Yes. Launching an attack engages section 3 of the Computer Misuse Act 1990, unauthorised acts with intent to impair the operation of a computer, which carries a maximum of ten years’ imprisonment. Section 3A separately criminalises making, supplying or obtaining articles for use in computer misuse, which covers buying a booter subscription. Terms of service claiming the tool is for authorised testing give a purchaser no protection.

What happens if someone on our network buys a booter subscription?

Expect it to become a disciplinary and legal matter as well as a technical one, since obtaining an attack service is itself an offence under section 3A. Preserve the logs, involve HR and your data protection lead, and for schools involve the designated safeguarding lead before anyone interviews a pupil. Your acceptable use policy should name stresser and booter services explicitly so the position is unambiguous.

How powerful are DDoS-for-hire attacks in practice?

Far smaller than panel advertising suggests. The realistic profile is low single-digit gigabits in bursts of roughly 30 seconds to five minutes, repeated across a working day, or a layer 7 flood of tens of thousands of requests per second that never troubles a bandwidth threshold. Small does not mean harmless: that shape defeats on-demand diversion and exhausts application workers long before it fills a transit link.

Will standard hosting or CDN protection stop a hired DDoS attack?

Sometimes, and it is worth having as a baseline. It fails in three predictable places: when your origin IP has leaked through historical DNS, certificate transparency or mail headers; when your authoritative DNS sits outside the protected scope; and when the flood targets a non-HTTP service such as a VPN concentrator or an API host that never passes through the proxy. Audit those three before assuming you are covered.

What should we do if a hired attack arrives with a ransom demand?

Do not pay, and do not negotiate on an open channel. Capture the demand, the wallet address, the timestamps and the attack evidence, mitigate through your provider, then report to Action Fraud and to your insurer. Low-value demands attached to short bursts usually signal a rented attack rather than a capable extortion group, which means the money buys you nothing beyond a reputation for paying.