It is if you do it with the intent to defraud people or to make a service inaccessible. Same thing with a denial of service attack. It's not illegal to visit a webpage, but it is illegal to visit a webpage millions of times per second to bring the server down.