Interest in booter services and distributed denial of service attacks: Insight from Google search data

Abstract

Cybercrime as a service is lowering the barrier to entry for crime. Aspiring criminals can access cybercrime services through the clear web using search engines. One such cybercrime service is booters, web platforms that offer affordable distributed denial of service attacks for hire. Law enforcement agencies have tried to counter this trend by running online ad campaigns on platforms like Google. For these campaigns to effectively divert and deter potential cybercriminals, they must first reach the intended audience. Yet, it remains uncertain whether this is the case. This study assesses Google online search data from two campaigns deployed in the Netherlands in 2021 to determine whether the campaigns actually reached potential cybercriminals. The results indicate that certain online searches likely had criminal intent, implying that the campaigns – to some extent – successfully reached the intended population. Furthermore, the findings reveal that online searches can serve to identify active booters, providing valuable assistance to law enforcement agencies in taking down such services.