Are the Days of “Booter” Services Numbered?
Summary: Researchers at Saarland University's CISPA, with Yokohama National University and Japan's National Institute of Information and Communications Technology, developed a method to link the mass Internet scans run by booter services to the amplification DDoS attacks that follow, identifying 286 scanners used by booters, roughly 75 percent of them located in the United States. Using honeypots called AmpPot and hop-count trilateration, they attributed about one-third of attacks back to their origin, and the group is sharing incident data with ISPs, hosting providers, Europol and the FBI.
What's compelling: Spoofed amplification attacks normally hide their source, so attributing a third of them to origin gives network providers and law enforcement something they rarely have; the researchers note their output can serve as forensic evidence in legal complaints.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026