DDoS Infrastructure as a Service: Pressure on Merchants and Payment Gateways

[Good Carder]

Introduction: A Cyberattack for the Price of Lunch​

Exactly $20, one click in a Telegram bot, and just over an hour are enough for the legendary "world in 15 minutes" of one Berlin instant noodle to turn your online business into a never-ending 503 error.

DDoS (Distributed Denial of Service) attacks are no longer the preserve of hacktivists with personal botnets. Today, they're a fully automated SaaS product — with a personal account, target builder, pricing plans, affiliate programs, and 24/7 support. The slogan "DoS yourself" is no longer a joke.

In this article, I'll examine the DDoS-as-a-Service industry, its rapidly declining costs, combined DDoS and carding attacks — a true weapon of mass distraction, the blind spots of payment gateways, and the multi-layered defense architecture that financial giants and marketplaces are already implementing.

Part 1. DDoS-as-a-Service: Dark SaaS Platforms Under Your Nose​

1.1. "Booter" and "Stresser": SaaS on the Other Side of the Law​

DDoS-for-hire is a service that provides access to a network of infected devices (a botnet) for a small fee. The client selects a target, the duration of the attack, and presses a button. The entire technically complex process of coordinating thousands of devices is hidden behind a web interface. These services call themselves "stress testing tools" to conceal their illegal nature. In 2023, according to Kaspersky, over 700 advertisements for such services were found on darknet forums.

Modern booth panels mimic legitimate SaaS products: attractive dashboards, attack duration sliders, clear target entry forms, and payment in cryptocurrency. Such services can be found on darknet forums, Telegram, and even on platforms like Discord and YouTube. Some offer free trials, affiliate programs, and in-house technical support.

The appeal of DDoS-as-a-Service lies not only in its simplicity but also in the asymmetry of price and damage. A phishing campaign to steal credentials costs an average of $158, and a single successful attack can recoup all costs. A ransomware attack on a small company costs $358 — the same as renting a single video surveillance server. A targeted breach of a protected infrastructure costs $33,000 — the cost of an average business-class car. The average damage from a single incident is $4.4 million.

1.2. The Explosive Market of 2026: Prices Fall, Opportunities Grow​

After analyzing approximately 4,300 ads on darknet forums, Positive Technologies confirms that cybercrime has transitioned to a service-based model. The technical barrier to entry has dropped to "pay and get results."

Median prices on the darknet (2026):

• Server infrastructure rental — $8
• DDoS attack — $20
• Access to stolen credentials — $20
• Exploit kits (mass market) — from $500 per month
• Zero-day exploits cost up to $150,000

In 2026, daily DDoS rental rates range from 20 to 10,000, and the cost of an attack can reach 100. Meanwhile, a specialized DDoS kit can be purchased for as little as 100.

1.3. IoT Botnets: Cheap Weapons of Mass Destruction​

The main "engine" of modern DDoS attacks are botnets of inexpensive and poorly protected Internet of Things (IoT) devices: home routers, IP cameras, smart speakers, and refrigerators. Millions of these devices can be infected with malware (for example, the Mirai or CatDDoS Trojan) and coordinated requests sent to a single target under the control of a single command and control center (C&C). This creates cheap but massive computing power for generating traffic exceeding 1 Tbps.

Part 2. Combined Attacks: DDoS as a Smokescreen for Carding​

2.1. Smokescreen Strategy​

Before launching automated testing of thousands of stolen cards, DDoS attackers can orchestrate a large-scale DDoS attack on a company's infrastructure. While the incident response team (SOC) is busy restoring website and application availability, hundreds of automated queries verify the validity of the stolen cards.

SOCs are often built with limited human and software resources. A DDoS attack creates noise, overloading the alert system, and diverts attention from quiet but dangerous operations in other parts of the infrastructure. Here's how attackers can disrupt your SOC's rhythm and how to get it back on track.

2.2. Attack Evolution: From Card Tests to Wholesale SOC Distraction​

These are no longer isolated cases, but an emerging trend. Experts from StormWall and Positive Technologies have clearly stated this: overloading SOCs and monitoring tools with noisy attacks (DDoS, mass phishing, bot attacks on forms) to generate a large number of alerts is one of the key scenarios for combined attacks. This is not a coincidence, but a planned tactic.

According to Akamai (May 2026), the financial industry remains the main target for DDoS attacks on web applications and APIs, and their median duration has increased by 738% compared to 2024. A 148% increase was also recorded compared to Q1 2025, a 34% increase globally, and a 31% increase in Russia. The most powerful attacks, with a capacity of over 2 Tbps, approaching 3 Tbps, were directed, among others, at banks and payment systems. The goal is to disable online banking and payment gateways, creating a window for carding.

2.3. Variations on a Theme: Multi-Vector and API Attacks​

Attackers combine attack layers (L3/4 with L7, such as SYN Flood and Slowloris), simultaneously masking each other. API vulnerabilities become gateways. Akamai's 2026 report shows that 96% of financial institutions experienced API security incidents in the past 12 months. Furthermore, by the end of 2025, advanced bot activity increased by 147%, and in one case, 96% of all website traffic was identified as malicious scraping.

Part 3. Multi-layered defense methods against combined attacks​

The security architecture is built on maximum isolation and depth of analysis. Imagine a multi-layered model, where each subsequent layer is responsible for mitigating a different threat category.

Layer	Technology	Purpose
Border	CDN with scrubbing centers	Absorption and filtering of large L3/L4 traffic, load balancing via Anycast
Intellectual	AI traffic analysis and behavioral models	Automatically detect new signatures and anomalies in real time
Applied	Web Application Firewall (WAF)	Blocking API- and web application-specific L7 attacks, injections, and OWASP Top 10
Adaptive	API Gateway Policies and Granular Limits	Limiting the request rate at the level of individual endpoints and user profiles

3.1. Edge Protection: CDN, Multi-CDN, and Scrubbing Networks​

CDNs distribute user requests across tens or hundreds of thousands of servers worldwide. If one server is down, the others continue to operate. Scrubbing networks analyze incoming traffic, allowing legitimate users through and blocking malicious packets at the edge.

Multi-CDN uses two or more CDN providers. If one fails, traffic is automatically switched to the other, providing resilience to geographic disruptions and assisting in DDoS mitigation. TLS and WAF policies are also standardized across CDNs to avoid inconsistencies in protection.

Modern technologies like Flood Shield 2.0 combine L3/L4 DDoS mitigation with a scrubbing capacity of 20+ Tbps, L7 DDoS mitigation against HTTP/S floods and slow attacks, WAF for protection against OWASP Top 10, and Bot Management for detecting and blocking malicious bots.

3.2. Intelligent analysis and behavioral scoring​

Modern anti-DDoS systems are moving away from manual rule management to machine learning (ML)-based systems that:

• Build statistical models of normal traffic and automatically update rules.
• They analyze the sequence of requests, the time between them and their diversity.
• Automatically generate filtering rules without human intervention.
• Analyze the legitimacy of the session, including the URL, Referer and User-Agent headers.

3.3. API Security and Granular Limits​

Financial services can granularly control requests at the API level:

• Rate limiting at the level of IP address and BIN range of cards.
• Blocking suspicious POST /v1/payment_intents from 5+ different cards from one IP.
• Increasing response delay for suspicious requests (tarpitting).
• Captcha for abnormal activity.

Multi-CDN strategies in hosting help apply standardized rules across all networks, reducing the attack surface and preventing configuration errors that subsequently lead to vulnerabilities.

3.4. Human Factors and Exercises​

Always conduct full-scale cyber exercises, practicing combined attack scenarios: a DDoS attack masking data theft. Invest in training and upgrading your SOC team so they can filter out false positives and promptly detect carding activity during a noisy DDoS attack.

Part 4. The Realities of 2026 and a Defense Checklist​

Attack growth statistics by industry:

Industry	Attack volume growth in Q1 2026
Financial (world)	+148%
Telecommunications (world)	+216%
Public sector (world)	+104%
Financial (Russia)	+74%
Telecom sector (Russia)	+61%
Retail (Russia)	+38%

The rise in attacks on financial institutions worldwide confirms that the industry is under attack. Payment gateways remain the most attractive target, with 60% of all web attacks and 83% of API endpoint intrusions occurring in the banking sector.

Here's a payment gateway security checklist:

• Implement a multi-CDN. Use multiple providers.
• Install WAF with automatic rule updates.
• Set up granular limits on API endpoints (IP/BIN bans, abnormal patterns within 10 minutes).
• Use behavioral analysis and ML to discover new vectors.
• Develop a combined DDoS + active carding response plan.
• Conduct SOC exercises to mitigate noisy DDoS attacks.
• Implement a bot deanonymization system (HTML traps, canary token injection).
• Set up automatic captcha in case of abnormal volume of API requests.

Part 5. Conclusion: The Price of Silence​

The modern threat landscape demands a paradigm shift: from manual rule management to AI analytics and behavioral scoring. DDoS is no longer an end in itself, but a means — cheap, accessible, and destructive. Combined attacks are a fact of life, and protection against them requires the coordinated work of SOCs, WAFs, API Security, and CDNs.

A payment gateway without flexible API rate limiting and behavioral analysis is a carder's shooting range, covered by a botnet smokescreen. Implement a multi-layered defense: a CDN will reduce volume, AI analytics will detect anomalies, a WAF will cut off L7 threats, and granular limits will finish off the rest.

A quick one-line reminder:
"DDoS is not an availability issue. DDoS is a paid carding smokescreen, rented for $20." Filter traffic at the edge of the network, count every API request, and don't let the SOC choke on noise while they test your payment cards."