Threat intel

On September 16 the US Justice Department announced that the FBI had seized nightmare-stresser.com and nightmarestresser.org, the two domains of NightmareStresser, one of the longest-running DDoS-for-hire services. A DDoS (distributed denial of service) attack floods a server or network link with traffic until real users cannot get through. According to the seizure warrant affidavit, customers used NightmareStresser for hundreds of thousands of actual or attempted attacks since 2022, against schools, government agencies, gaming platforms and millions of individuals.

Services like this are called booters or stressers. They pose as network "stress testing" tools and need no technical skill from the customer, so anyone with a grudge can knock a website or office connection offline for the price of a meal. Any public website, VPN gateway or game server is in range. The seizure removes one supplier for a while, and research on earlier seizures shows the market recovers within weeks.

How a booter attack works

The customer types a target IP address or URL into the booter's website, picks a method and a duration, and clicks start. Searchlight Cyber, which studied NightmareStresser in 2023, found plans from €25, for attacks of up to 1,800 seconds with one running at a time, to €19,999 for 86,400-second attacks with 400 at once. The service advertised up to 200 Gbps (gigabits per second) of attack traffic, far more than a typical business internet line can carry.

Most of that traffic does not come from the booter's own servers. The default booter method is reflection and amplification over UDP, the connectionless protocol behind DNS and NTP. Because UDP has no handshake, the sender can write any source address into a packet. The booter sends small queries to thousands of public servers and forges the victim's address as the sender. Each server sends its answer to the victim, and the answer is many times larger than the question.

The protocols chosen are the ones with the biggest gap between request and reply. CISA's figures give a bandwidth amplification factor of 28 to 54 for DNS, 556.9 for NTP (through the old monlist command, which returns the last 600 addresses the server has talked to) and 56 to 70 for CLDAP, the connectionless LDAP that Windows domain controllers answer on UDP port 389. Memcached, a caching server that was never meant to face the internet, reaches 10,000 to 51,000. Researchers who studied the December 2018 booter seizures found the services mostly sold NTP attacks, with CLDAP, DNS and memcached alongside, and NETSCOUT saw memcached move from skilled attackers to booter menus.

NightmareStresser's 28 methods covered Layer 4 (TCP and UDP floods like the ones above) and Layer 7, the application layer. A Layer 7 attack sends a flood of ordinary-looking HTTP requests to a website, aimed at pages that are expensive to build, such as search or login. It needs far less bandwidth, because it exhausts the web server and database instead of the network link.

What the seizure achieves

This is the second time NightmareStresser has lost its domain. Its older nightmarestresser.com was among 48 booter domains seized in December 2022, and the service carried on. The Justice Department did not announce any arrests or charges against its operators this time. The FBI's Anchorage Field Office ran the case with the Royal Canadian Mounted Police as part of Operation PowerOFF, an international effort against DDoS-for-hire services. Over eight years, the related Alaska and Los Angeles investigations have charged 12 defendants and seized more than 100 domains.

A University of Cambridge study of the PowerOFF seizures that started in December 2022, published at USENIX Security 2025, measured what such takedowns do. Over half of the sites seized in the first wave were back within a median of one day, and all of those in the second wave within a median of two days. The returning sites lost 80 to 90% of their visitors, and the first wave cut global DDoS attack volume by 20 to 40%, with the clearest effect on UDP attacks. The effect lasted about six weeks at most.

What to do

These steps suit a mid-sized organization without a dedicated network team, in this order.

1. Find out what your upstream will do. Ask your ISP, hosting provider or cloud platform in writing: is DDoS mitigation included, is it always on or does someone have to switch it on, what size of attack does it cover, and who do you call at 2am? On cloud platforms, check whether the resources that matter need a paid tier such as AWS Shield Advanced or Azure DDoS Protection. Write the answers into your runbook.

2. Put public web apps behind a content delivery network (CDN) or web application firewall (WAF). A CDN absorbs volumetric floods on its own network, and the WAF lets you filter Layer 7 attacks. Set rate limits on login, search, password reset and API endpoints, for example a cap on requests per minute per client IP, and learn where the "under attack" or challenge setting lives so you can turn it on quickly.

3. Keep the origin server hidden, because a CDN does not help if attackers can reach your server directly. Allow inbound HTTP and HTTPS on the origin only from the CDN's published address ranges, and check that no old DNS record or forgotten subdomain points at the origin (certificate transparency logs make such subdomains easy to find) and that outgoing mail headers do not reveal it. If the origin IP has been public for years, change it when you move behind the CDN.

4. Make sure your servers cannot be used as reflectors. Scan your own public ranges from outside, for example with nmap -sU -p 53,123,389,11211 <your-range>, and fix what answers:

   • DNS: an internet-facing server should not recurse for outsiders. nmap -sU -p 53 --script dns-recursion <ip> shows whether it does. In BIND, limit allow-recursion to your internal networks, and turn on response rate limiting on authoritative servers.
   • NTP: run a current ntpd, where monlist is gone (CISA pointed to 4.2.7p26 or later), or add disable monitor to ntp.conf on older builds. nmap -sU -p 123 --script ntp-monlist <ip> confirms it no longer answers.
   • CLDAP: block UDP 389 from the internet to every domain controller at the firewall.
   • Memcached: disable UDP with -U 0 (the default since version 1.5.6) and bind it to localhost or a private network.

   The Shadowserver Foundation sends network owners free reports of open resolvers, NTP and memcached servers it finds in their address space.

5. Write a short DDoS runbook. It needs the provider contacts and account numbers from step 1, who can approve turning on paid mitigation, how to switch DNS or routing to the CDN or scrubbing service, and which services you would drop first to protect the important ones. Test the switch once a year.

To tell during an incident whether you are the target of a reflection attack, look at your firewall or flow logs for a surge of inbound UDP from source ports 53, 123, 389 or 11211 that your hosts never asked for. The same ports as source ports on outbound traffic mean your own servers are being used as reflectors. For a Layer 7 flood, your web server or WAF logs will show a spike in requests to one or two paths, often with many client IPs and similar user agents.

Open resolvers, exposed memcached and domain controllers answering on UDP 389 are the kind of findings our network penetration testing turns up and helps you close. Our security operations team watches for traffic spikes and helps run the runbook during an attack. To find out how your network would hold up, open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the check.

---

Sources: US Department of Justice, District of Alaska, Security Affairs, FastNetMon, Bitdefender, Hackread, BleepingComputer, Searchlight Cyber, Vu et al., USENIX Security 2025, Kopp et al., DDoS Hide and Seek, CISA, NETSCOUT.