No, but for the most part they don't need to. 1) It's not just LOIC users DDoSing. There are usually small to medium sized botnets involved, especially on big

No, but for the most part they don't need to. 1) It's not just LOIC users DDoSing. There are usually small to medium sized botnets involved, especially on big attacks. 2) You said it yourself - there are tens of thousands of clients involved, and it's often difficult to tell because of #3 (unless there's a TCP/UDP message specified, which is a surefire way to ID attacks) 3) Most LOIC users use the /hivemind option, which turns control over to a master in an IRC channel. It can selectively throttle (most) clients, and spread the work around the net to make the attack more difficult to block. 4) They've got a standard line for getting caught[1] (sorry for the offensive URL) The other thing to note is the time and expense involved in trying to identify and prosecute a few thousand people for participating would be enormous. We'll have to see if they try this time. [1] http://encyclopediadramatica.com/LOIC#Newfags_FAQs http://encyclopediadramatica.com/LOIC#Newfags_FAQs