The internet mafia trope has shaped our knowledge about organised crime groups online, yet the evidence is largely speculative and the logic often flawed. This paper adds to current knowledge by exploring the development, operation and demise of an online criminal group as a case study. In this article we analyse a DDoS (Distributed Denial of Service) stresser (also known as booter) which sells its services online to enable offenders to launch attacks. Using Social Network Analysis to explore the service operations and payment systems, our findings show a central business model that is similar to legitimate e-commerce websites in the way product, price and costumers are differentiated. It also illustrates that its organisation is distributed and not hierarchical and the overall income yield is comparatively low, requiring further organisational activity to make it pay. Finally, we show that the users of the service (mainly offenders) are not only a mixed group of actors, but that it is also possible to discriminate between different levels of seriousness of offending according to the particular service they purchased.

互联网黑手党的比喻塑造了我们对在线有组织犯罪集团的了解，但证据主要是推测性的，而且逻辑往往有缺陷。本文通过探索在线犯罪集团的发展、运作和消亡作为案例研究，增加了当前的知识。在本文中，我们分析了一个 DDoS（分布式拒绝服务）压力器（也称为引导程序），它在线销售其服务以使犯罪者能够发起攻击。使用社交网络分析来探索服务运营和支付系统，我们的研究结果显示了一个与合法电子商务网站在产品、价格和客户差异化方式上相似的中心商业模式。也说明它的组织是分散的，没有等级的，整体收益比较低，需要进一步的组织活动才能使其付出代价。最后，我们表明服务的用户（主要是犯罪者）不仅是一个混合的行为者群体，而且还可以根据他们购买的特定服务区分不同程度的犯罪严重性。