A case study on turning inside out a leaked booter database from a threat intel position and also from a defender position. The aim is to offer insight into the DDoS "market" and in the same time understand the type of data available for a better protection against these types of attack, the ideal combination between attribution leads and threat intel.