People who have money to rent DDoS services from criminals also have money to rent VPNs that use US residential IP addresses (usually from home computers infected with malware under the control of criminals)