Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Matthew Gatrel, who ran the DownThem DDoS-for-hire service, was sentenced to 24 months in federal prison on June 13, 2022. A jury had convicted him of three computer- and wire-fraud felonies after a nine-day trial. DownThem sold access to attacks that could knock websites and other internet services offline; prosecutors said its customers launched more than 200,000 attacks.

Who ran DownThem, and what was it?

Gatrel, 33, of St. Charles, Illinois, operated DownThem.org and AmpNode.com, according to the U.S. Department of Justice’s June 13, 2022 sentencing announcement. DownThem was a paid DDoS service, often called a “booter” service: customers paid to direct distributed denial-of-service attacks at chosen targets.

A DDoS attack overwhelms a website or other online service with traffic or requests, making it difficult or impossible for legitimate users to reach it. DownThem’s subscription plans offered differing attack duration and power, including the ability to run attacks concurrently, the DOJ said.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How did the service carry out attacks?

DownThem sold access to attacks, while AmpNode supplied hosting and infrastructure. The DOJ described AmpNode as a “bulletproof” hosting provider and said it offered spoofing support, attack scripts and lists of vulnerable servers that could be used as “attack amplifiers.”

The attacks used reflection and amplification: attackers sent requests to other internet-connected servers while forging the apparent source address so that the servers’ replies went to the victim. Amplification caused those replies to be larger than the original requests. The DOJ said the scheme unlawfully appropriated resources from hundreds or thousands of other servers to flood targets.

How many attacks were attributed to DownThem, and who was targeted?

The DOJ’s December 2018 seizure announcement said DownThem’s database showed more than 2,000 customer subscriptions between October 2014 and November 2018, and that the service had been used to conduct or attempt more than 200,000 DDoS attacks. In its 2022 sentencing announcement, the DOJ also reported more than 2,000 registered users and more than 200,000 launched attacks.

Those were attacks worldwide against a range of targets, including homes, schools, universities, municipal and local government websites, and financial institutions, the DOJ said. The figures describe the scale reported by federal authorities; they do not mean every attack succeeded or that each subscription belonged to a different person.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why was Gatrel sentenced to prison?

After a nine-day trial in September 2021, a federal jury convicted Gatrel of three felonies: conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer. U.S. District Judge John A. Kronstadt sentenced him to 24 months in federal prison on June 13, 2022, according to the DOJ.

The sentence followed a trial and jury convictions, rather than a guilty plea by Gatrel. The DOJ’s announcement reproduced prosecutors’ description of the operation as a criminal enterprise built around carrying out hundreds of thousands of cyberattacks for customers.

What happened to co-defendant Juan Martinez?

The DOJ identified Martinez as a former DownThem customer who became a co-administrator in 2018. He pleaded guilty in August 2021 and received five years’ probation.

What happened after the sentence?

A 2024 Supreme Court petition states that the Ninth Circuit affirmed Gatrel’s district-court judgment on December 22, 2023, and denied rehearing and rehearing en banc on April 1, 2024. That filing documents those appellate milestones; it does not establish whether the Supreme Court took any later action.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Did authorities seize DownThem?

On December 19, 2018, the FBI announced the seizure of 15 booter-service domains, including downthem.org, following an operation in which it said the services had been tested. The DOJ’s 2022 announcement said the investigation involved the FBI’s Anchorage Field Office and its Los Angeles Cyber Initiative and Resource Fusion Unit, with assistance from Akamai Technologies, Cloudflare, DigitalOcean, Google, Palo Alto Networks Unit 42, the University of Cambridge Cyber Crime Centre and Unit 221B.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Is launching or hiring a DDoS attack illegal?

The FBI said both launching a DDoS attack and hiring a service to do it are criminal activity. In the DownThem case, Gatrel was convicted of federal offenses involving unauthorized impairment of protected computers and conspiracy to commit computer and wire fraud. The case illustrates that paying someone else to launch an attack does not make the conduct lawful. The precise charges and penalties in any other case depend on its facts and the laws that apply.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.