Booter, stresser, DDoS-for-hire: one product, three names
All three terms describe the same thing: a web storefront where attacks are a product. The customer never touches the attack infrastructure — they buy access, paste a target, pick a duration, and the service does the rest. The 'stresser' branding claims a legitimate purpose (load-testing servers you own), but authorization checks are rare to nonexistent, and seized-site records consistently show the targets are other people's servers.
The economics: why attacks are so cheap
Booter subscriptions commonly run $5–30 per month, with tiers sold on attack size, duration and how many attacks you can run concurrently. That price is possible because the operator's costs are spread across thousands of customers and the traffic often comes from abused infrastructure. The asymmetry is the whole problem: the attacker spends less than the price of a game skin; the defender loses playercounts, reputation and sometimes their hosting contract. That asymmetry is also why defense has to be cheap to be realistic — it's the reason a $0 protection tier matters.
What a booter attack looks like against Minecraft
- Volumetric floods — raw traffic aimed at your IP to saturate the host's bandwidth. The server process may be fine; the pipe to it isn't. Hosts often respond by null-routing your IP, finishing the job.
- Minecraft-protocol attacks — floods of status pings or fake join attempts that speak valid protocol. Tiny bandwidth, devastating effect: the server drowns in handshakes and logins instead of packets.
- Short bursts, on a schedule — booter plans meter attack time, so hits often last 5–60 minutes and recur at peak hours or during events, when the damage to your community is largest.
- Personal timing — the attack lands minutes after a ban, a faction war loss, or an argument in chat. Booter attacks are usually grudges, not randomness.
The legal reality
In the US (Computer Fraud and Abuse Act), the UK (Computer Misuse Act), the EU and most other jurisdictions, launching a DDoS attack against infrastructure you don't own is a criminal offense — for the customer, not just the operator. International operations have repeatedly seized booter domains and followed up with the payment records, and 'I was 15 and it cost $10' has not been a defense. If someone is attacking your server, the answer is defense and (for sustained harassment) a report to your local cybercrime unit — never a retaliatory attack, which simply makes you a second criminal.
Defending against booter attacks
You can't stop someone from buying an attack, but you can make it hit nothing. The defense is architectural: get your real IP out of public DNS and put a filtering network in front, so attack traffic — volumetric or protocol-level — is absorbed and parsed before it reaches your host. Arvoris does this with a 500+ Tbps anycast edge feeding Cryo, a Minecraft-aware Layer-7 filter, with antibot verification for the bot waves booters bundle; setup is one DNS record and the free plan covers 15 players. If you suspect an attack is happening right now, start with the emergency response guide.
Common questions
What is a booter in simple terms?+
A booter is a website that sells DDoS attacks as a service: pay a subscription, enter a target IP, click a button, and the operator's infrastructure floods that target with traffic. 'Stresser' is the same product wearing a fig leaf — marketed as testing your own servers, overwhelmingly used against other people's.
Are booters illegal?+
Using one against a server you don't own or have written authorization to test is illegal in most jurisdictions — it's computer misuse / unauthorized interference, the same family of law as hacking. Law enforcement regularly seizes booter sites and prosecutes both operators and paying customers, including minors. Nothing on this page should be read as advice to use one.
Why are Minecraft servers such common booter targets?+
Because the attacker is often in the community: a banned player, a losing faction, a rival server. Targets are easy to find (server lists publish addresses), the audience is young enough that a $10 attack feels like a prank rather than a felony, and an unprotected server visibly dies — which is the attacker's payoff.
How do I know if a booter is being used on my server?+
Typical signs: everyone lags or times out at once, the hitcount spikes in your host's traffic graphs, attacks start right after a ban or argument, and they stop after 5–60 minutes (booter plans sell attack time in short bursts). A diagnosis walkthrough is in the guide on telling whether you're being DDoSed.
Can a $10 booter really take down my server?+
If the server's IP is public and unprotected — usually yes. Even low-end booters push far more traffic than a typical hosting allocation absorbs, and Minecraft-specific attack scripts (join floods, ping spam) need very little bandwidth to lock up a server. Behind a filtering edge, that same attack hits 500+ Tbps of anycast capacity and protocol-aware filtering instead of your node.
Related reading: is my server being DDoSed? for diagnosis, and why you need protection for the broader threat picture.