In March a forum ad for DDoS services promised to “raise your site in the search and lower the competitor’s site below”. It asked from $100 for a day, took bitcoin or other coins, and accepted a guarantor service. If problems arose, it said, it would “solve in favor of the client” with money back. The dollar sign carries no stated denomination (HD-O011 in the offer catalogue).
In 48 of the 259 ad clusters (19%), sellers framed DDoS as phishing or lookalike-site cleanup; 40 of the 85 clusters whose representative advertisement was tagged Indonesian did so (47%). That pitch sells temporary absence: an unreachable page can return when the attack stops. It does not establish removal by the host or registrar.
That ad shows what commercial DDoS-for-hire sells. One product is an outcome for a private customer: a target held offline for hours or days. The other is rented capacity: a plan, slots or a tool the buyer runs.
A hacktivist claim does something else. It publishes a political message and a list of about five targets as free publicity.
The two still look alike, because both attach a third-party reachability report as proof. We read 259 template clusters of for-hire ads (6,723 collected posts) against 4,698 hacktivist-relevant posts. These are advertised terms. We bought nothing and tested nothing.
What Is the Buyer Paying For?
The ads name commercial results. Of the 259 clusters, 49 name gambling or betting sites as targets and 38 name competitors or rivals. Another 21 name game servers. Politics or ideology appears in one cluster.
A Chinese-language ad prices by target difficulty and offers a refund if the target does not go down (HD-O016). Categories overlap, because one ad can list several. The counts below are clusters, not advertisers, and a cluster can sit in more than one row.
| Target Type Named in the Ad | Template Clusters |
|---|---|
| Websites or servers, generic | 144 |
| Gambling, betting or chess-card platforms | 49 |
| Phishing or lookalike brand sites, framed as takedown | 48 |
| Competitors or rivals | 38 |
| Game servers or private servers | 21 |
| Government or education sites | 19 |
| Apps | 13 |
| Online shops | 6 |
| News sites | 4 |
Time Offline or Rented Capacity: Two Products, Two Price Units
The first product sells time offline. A per-hour menu lists IDR 120,000 for one hour, 240,000 for three, 500,000 for six and 1,000,000 for a day. It shows dollar equivalents of $10 to $70 beside them (HD-O006). Six hours cost about four times one hour, and a day about eight times.
Protection raises the price. One hold-service menu asks $3 to $5 per hour for a small site. For government or education sites it gives an estimate of $25 to $90 per hour, before a protection check (HD-O012). Per-hour units appear in 41 clusters and per-day units in 43.
The second product rents capacity, and the buyer runs it. One Indonesian list starts at IDR 15,000 for one day, with a 60-second limit per run and one concurrent run. It reaches IDR 650,000 for a month, with 800 seconds and five concurrent runs (HD-O004).
A Turkish API ad sells monthly slots. One slot of 60 seconds costs $15, three slots of 900 seconds $120, and eight slots of 1,200 seconds $200 (HD-O007). Plans, slots or concurrency appear in 63 clusters, week, month or lifetime plans in 58, and API, command-and-control or reseller access in 58.
Other capacity units appear. One English list prices botnet access in euro by claimed size. It runs from EUR 250 for 30 days at a claimed 1T UDP and 10,000 bots to EUR 3,000 at a claimed 8-10T and 100,000 bots (HD-O008).
A one-off script costs IDR 15,000 (HD-O018), and source code with setup IDR 5,000,000 (HD-O017). Capacity and bot counts are the seller’s claims. A three-hour plan costs $20 without “bypass” wording and $35 with it (HD-O009).
The split matters when you read a price. A hold service charges for a result and, on its advertised terms, carries the risk if it fails. A capacity rental charges for access, and success is the buyer’s problem. Every price here is an advertised asking price, with the unit and denomination as written.
Stated restrictions contradict each other. One ad forbids government and education targets and says it serves “competitive needs only” (HD-O013). Another advertises no limits “including gov and edu” (HD-O014). Such lines are advertising copy, not evidence of what was done.
How Do Sellers Reassure a Buyer Who Cannot Check?
A private buyer cannot inspect delivery, so the ads spend their words on trust. Of the 259 clusters, 53 offer a trial or test and 46 show a proof practice such as a report link or testimonial channel. Another 39 accept escrow and 30 carry refund or guarantee wording. Only 36 carry capacity wording (Gbps, Tbps or similar), all as the seller’s claim.
The terms differ in telling ways. An Indonesian ad offers a two-minute test on the buyer’s own target (HD-O002). The forum ad above gives a free test only to “people with a reputation”, and a Russian-language variant charges $10 that is credited to the order. A Turkish ad even says its attacks will not work on every target.
These are answers to the question a paying customer asks: will it work, and what if it does not? Several hold services answer with refund promises, and several capacity rentals with trials. A hacktivist claim faces a different problem. It needs an audience, and the claim posts we read quote no refund or guarantee.
What Does “Phishing Cleanup” Mean in a DDoS Ad?
The most surprising framing is takedown. In 48 of the 259 clusters (19%) the ad sells its service as a way to remove phishing or lookalike sites. Forty of the 48 are Indonesian, which is 40 of the 85 Indonesian clusters (47%). The 19% blends a language mix, so the Indonesian share is the fairer cut.
The wording is specific. One ad family offers “your phishing brand site” cleanup with trial access (HD-O003). A source-code ad calls itself suited to taking down scam links and lookalike sites (HD-O017).
A mixed post offers to remove a phishing page from search results for a written “600-1jt”, with a full refund if it stays, and lists hourly DDoS separately. We do not count it as a DDoS offer (HD-O015).
These are advertised promises. We cannot say whether any brand bought them or any page was affected.
Three details matter to a brand-protection team. First, selected cleanup ads price hours or days of unreachability. Selected posts also advertise permanent suspension or removal from search results; those are claims too. A registrar or host removal ends the page, while the selected hour- or day-based offers advertise temporary unreachability.
Second, the same ads list rivals, gambling sites, government sites and “KW” lookalike brands in the same breath. Two ads ask whether the buyer wants a phishing page gone or “a site you dislike” unreachable. The word phishing is the seller’s label. An ad cannot show that its target was malicious, so a lookalike brand or a rival can sit under the same banner.
Third, the pitch addresses brand owners directly, in the manner of “is your brand being phished?”. The framing does not change the legal position. In the UK, making, supplying or obtaining a booter or stresser service to facilitate DDoS is an offence under the Computer Misuse Act, as the National Crime Agency states.
For a team that tracks phishing infrastructure, the consequence is a change in what “site down” means. A lookalike page that goes dark has not necessarily been taken down. Record why it went dark, keep a capture from before, and check whether it returns.
Ask any takedown vendor in writing which methods it uses. Our digital risk protection work treats removal by the host or registrar as the outcome that counts.
Same Proof Format, Different Customers
Both sides cite reachability reports, so the format cannot separate them. The hacktivist and for-hire groups do meet. A saved aggregate records 34 generic commercial-brand token matches among 4,698 hacktivist-relevant posts. This screen is broader than a confirmed footer credit and does not establish a commercial relationship.
A target claim from April shows a similar credit line at the top of a single-target post (HD-C022). A sales ad that borrows the claim format is recorded in HD-C024.
The traffic also flows the other way. A separate coded scan records two for-hire-content posts among the 1,774 target-claim posts. This limited content overlap does not establish payment, ownership or coordination.
Separately, 153 posts with a reachability link sit outside the claim counts as unrelated, and 134 of them use for-hire vocabulary. A rule that counts any post with a proof link would add those seller posts to a hacktivist tally.
One check does not help. We found 90 distinct report IDs in for-hire posts and 3,975 in target-claim posts, with none in common. Report IDs belong to single check runs, so the zero shows only that neither set reposted the other.
| Dimension | For-Hire Ad | Hacktivist Claim |
|---|---|---|
| What is promised | A target held offline, or capacity to do it | A political message and about five listed targets |
| Who pays | The buyer, by hour, day, plan or slot | No customer transaction stated in the claim list, which is free publicity with political headers instead of sale offers |
| Header | Benefit and contact line | A stated trigger in 216 of 578 NoName057(16) claim events |
| Proof | Test, proof channel or testimonials in 46 of 259 clusters | A report link for every target in 75% of the 578 events |
| Own caveats | Rare, with refund wording in 30 clusters | The claimant’s own geo-block or dead-ping remark on about three in ten entries |
The header is what separates the two. A reachability link alone does not establish that a check ran, what it returned or who ordered it.
One Ad, 6,028 Copies: What the “ddos” Spike Recorded
The largest single text is a Chinese-language ad that takes orders around the clock and names no price (HD-O001). It accounts for 6,028 of the 6,723 collected for-hire ad posts (89.7%). Those copies come from three channels, and no two are byte-identical.
The differences are mostly invisible. Of 789 collected May copies, 785 contain invisible characters. In June it is 578 of 1,120, and later copies differ by a leading symbol or an added line. Exact-text matching therefore counts 6,028 different posts, while a reader sees one advertisement.
This explains the raw “ddos” spike in May and June. In the sampled “ddos” keyword set, for-hire ads make up an estimated 86.9% of posts in those two months, and one ad cluster holds 82.6%. The explanation is about what the spike contained. It does not say why it started.
The template persisted. It has 3,508 collected copies in September and October. The raw “ddos” total for September (9,419) was more than double August’s (4,161), with 74% of the sampled posts in Chinese. We draw no trend from this, because the sets are samples and channel coverage changed.
The consequence is for anyone counting DDoS chatter. A rise in the word “ddos” on Telegram can be one seller re-posting one advertisement. It does not show more political activity, and it does not belong in a count of hacktivist claims. Our companion study of how one hacktivist claim becomes many posts shows the opposite problem, where one real claim appears in several languages.
What Changes for a Defender
Separate the two by header and purpose, not by proof format. A post that sells hours, plans or tools is a commercial ad. A post that lists targets under a political trigger is a claim. The main investigation into hacktivist DDoS claims sets out what a claim post records.
For brand protection, treat a lookalike page going dark as a lead, not a result. Law enforcement works on the supply side. Cloudflare’s H1 2026 report says Operation PowerOFF targeted over 75,000 DDoS-for-hire users. Europol describes it as a global effort aimed at dismantling criminal DDoS-for-hire infrastructure.
The Fraud chapter shows the same habit of reading what an offer actually transfers, in its comparison of phishing service terms. The Hacktivism and DDoS research chapter holds the claim and offer catalogues.
Method and Scope
Scope. Collected posts from 1 January to 27 October 2026, Telegram-dominated (96 forum posts among 6,723 ads), from ten keyword sets. The “ddos” and DDoS-class sets are samples. Counts are posts, distinct texts and template clusters, never attacks, advertisers or sales.
For that language comparison, each cluster takes the language of its for-hire advertisement with the most collected copies. The offer-terms summary uses this representative rule, rather than the most common language across the whole cluster.
Prices come from a purposive set of 25 reviewed records. We keep each unit and denomination as written, convert nothing and compute no averages. Capacity, bypass and refund wording was not tested.
Precision. A blind second reading by the same AI worker agreed on 129 of 149 texts (86.6%). All 26 sampled for-hire ads agreed, but a full pass over the 259 clusters had already corrected about ten, so that figure is optimistic. An independent human re-read is still open.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
