I didn't see where the website owner specifies that they will illegally DDoS a website. It could actually be a brilliant strategy, take a payment for DDoSaaS then after the payment has been received, ask for proof from the client that the website they have requested DDoS'ed is their own (as an analytic tool to see how your website would perform under attack perhaps). If they can't provide the proof, the site owner is not allowed to perform the DDoS, with no need to refund the money, as anyone complaining about failure to furnish advertised service would be incriminating themselves.<p>EDIT: I completely failed to watch the video. It is pretty specific, hopefully a joke. Perhaps the real business model here is (since it says it only accepts serious requests from businesses) to pivot to Blackmail-as-a-service (BmaaS?)