See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an...

See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)