A hacking service that helped buyers knock websites offline has been shut down.
Today, law enforcement pulled the plug on Webstresser.org, the world's biggest marketplace for distributed denial-of-service (DDoS) attacks. Police in Europe and Canada also arrested the site's administrators while "further measures" were taken against the site's "top users" in the Netherlands, Italy, Spain, Croatia, the United Kingdom, Australia, Canada, and Hong Kong.
Police seized Webstresser.org's servers, meaning details of the 136,000 registered users have probably been exposed to law enforcement. Those customers used the service to launch at least 4 million attacks. Online systems from banks, government institutions, and police forces were among the targets, Europol said.
WebStresser.org started in 2015 and sold subscriptions for as little as $18.99 a month, which let you send a flood of data traffic to a website or IP address, interrupting the target's internet access.
DDoS-for-hire services are popular among gamers who want to knock their opponents offline. But they also make it easy for anyone to launch a crippling DDoS attack against a rival business or a site espousing views a repressive regime might want to squash.
Webstresser.org was available on the open web (versus the dark web), making it easily accessible. To try and avoid liability for the DDoS attacks, Webstresser.org advertised itself as a "server stress testing" provider. But clearly, police didn't care for that pretense.
"DDoS attacks are illegal," Europol said on Wednesday. "The penalties can be severe: if you conduct a DDoS attack, or make, supply or obtain stresser or booter services, you could receive a prison sentence, a fine or both."
Officials called Wednesday's action a warning to all "wannabe DDoS-ers."
This isn't the first time a DDoS-for-hire service has gone under. But despite Wednesday's takedown, many other "IP stressing" or "booter" services still remain online, and might now benefit from Webstresser's demise.