Big Pipes: the volunteer sleuths whose honeypots took down DDoS-for-hire sites

Big Pipes began at the Slam Spam conference in Pittsburgh in 2014, when security researcher Allison Nixon, then at Deloitte, proposed a collaboration to FBI agent Elliot Peterson, fresh from the takedown of the Game Over Zeus botnet. Their target: 'booter' or 'stresser' services that sell distributed-denial-of-service attacks as a subscription — often around $20 for multiple attacks — letting gamers and grudge-holders flood rivals' connections with junk traffic.

The group that formed — roughly 30 members on Slack and weekly calls, drawn from major cloud providers, gaming companies, academia and a few FBI agents and prosecutors — took its name from the joke 'big pipes start fights'. Nixon and Clayton built sensor networks — honeypots that joined hackers' botnets or posed as reflection servers to record attack commands — while industry members contributed years of firsthand victim-and-defender knowledge, and volunteers unmasked operators from their own forum posts and ad sites.

The pipeline worked: a December 2018 takedown arrested three hackers and knocked a dozen booter services offline; Operation Power Off in December 2022 led to six arrests and the takedown of no fewer than 49 DDoS-for-hire sites — the biggest bust of its kind; and in May 2023 the FBI announced the takedown of 13 more cyberattack-for-hire services — all three operations originating inside the group. Clayton's warning to survivors: if you weren't seized this time, you might conclude your odds of investigation just went up — 'you might not want to wait and see what happens'.

Pair honeypots that join botnets and pose as reflection servers with the biggest infrastructure operators, turning attack measurement into prosecution evidence.

The honeypots inverted surveillance: researchers stood inside the botnets and reflection servers, recording attack commands as they were issued.

Membership itself was the mechanism — the operators of the internet's biggest pipes were also the booters' collateral victims, so measurement, motivation and evidence lived in the same room.

Embedding prosecutors and agents in an informal group cut the distance between a lead and a lawful takedown to a Slack message.

An informal working group can outperform institutions: give volunteers with sensors and victims with data a direct channel to prosecutors, and the case pipeline builds itself.

By May 2023 Big Pipes had seeded three major takedowns in five years — 2018's arrests, Operation Power Off's six arrests and 49 seized sites, and the 13-service operation announced that May — with the group still tracking the booters that remained online. Operations appeared to be accelerating.