{"table":"infrastructure_items","columns":["reference_id","takedown_reference_id","takedown_slug","kind","identifier","quantity","quantity_qualifier","action","country_code","notes"],"row_count":88,"research_cutoff_on":"2026-08-21","generated_on":"2026-08-21","terms":"Free to reuse with attribution to the Internet Takedown Index. A research aggregation of public reporting, not a legal reference.","rows":[{"reference_id":"infra_silk_road_onion","takedown_reference_id":"td_2013_silk_road","takedown_slug":"silk-road-seizure","kind":"onion_service","identifier":"silkroadvb5piz3r.onion","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"Primary Silk Road hidden service, replaced with an FBI seizure notice."},{"reference_id":"infra_silk_road_servers","takedown_reference_id":"td_2013_silk_road","takedown_slug":"silk-road-seizure","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"IS","notes":"Servers supporting the marketplace, reported to include infrastructure in Iceland. Exact count not published."},{"reference_id":"infra_silk_road_btc","takedown_reference_id":"td_2013_silk_road","takedown_slug":"silk-road-seizure","kind":"crypto_wallet","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Bitcoin seized in the 2013 action; a much larger tranche of approximately 69,370 BTC was separately seized in November 2020."},{"reference_id":"infra_onymous_hidden_services","takedown_reference_id":"td_2014_operation_onymous","takedown_slug":"operation-onymous","kind":"onion_service","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Silk Road 2.0 plus dozens of additional dark market hidden services. Counts reported range from 27 to more than 400 addresses depending on source. CONFLICTING and not harmonized."},{"reference_id":"infra_onymous_servers","takedown_reference_id":"td_2014_operation_onymous","takedown_slug":"operation-onymous","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Servers seized across multiple European countries."},{"reference_id":"infra_alphabay_service","takedown_reference_id":"td_2017_alphabay","takedown_slug":"alphabay-seizure","kind":"onion_service","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"AlphaBay hidden service taken offline and replaced with a seizure notice."},{"reference_id":"infra_alphabay_servers","takedown_reference_id":"td_2017_alphabay","takedown_slug":"alphabay-seizure","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Servers seized in multiple countries including Canada, the Netherlands, and Lithuania."},{"reference_id":"infra_hansa_service","takedown_reference_id":"td_2017_hansa","takedown_slug":"hansa-covert-takeover-and-shutdown","kind":"onion_service","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"taken_over","country_code":"NL","notes":"Marketplace covertly operated by Dutch police for approximately one month before shutdown."},{"reference_id":"infra_hansa_servers","takedown_reference_id":"td_2017_hansa","takedown_slug":"hansa-covert-takeover-and-shutdown","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Servers seized in the Netherlands, Germany, and Lithuania."},{"reference_id":"infra_hydra_servers","takedown_reference_id":"td_2022_hydra","takedown_slug":"hydra-market-server-seizure","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"DE","notes":"German-hosted server infrastructure supporting Hydra Market. Exact server count not published."},{"reference_id":"infra_hydra_btc","takedown_reference_id":"td_2022_hydra","takedown_slug":"hydra-market-server-seizure","kind":"crypto_wallet","identifier":null,"quantity":543,"quantity_qualifier":"approximately","action":"seized","country_code":"DE","notes":"Approximately 543.3 BTC seized in 88 transactions, worth roughly 23 to 25 million USD at the time. Valuation varies by source."},{"reference_id":"infra_archetyp_servers","takedown_reference_id":"td_2025_archetyp","takedown_slug":"operation-deep-sentinel","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"NL","notes":"Marketplace server infrastructure seized by Dutch police."},{"reference_id":"infra_archetyp_service","takedown_reference_id":"td_2025_archetyp","takedown_slug":"operation-deep-sentinel","kind":"onion_service","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"Hidden service taken offline and replaced with a seizure notice."},{"reference_id":"infra_raidforums_domains","takedown_reference_id":"td_2022_raidforums","takedown_slug":"operation-tourniquet","kind":"domain","identifier":"raidforums.com","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Seized and redirected to a seizure notice."},{"reference_id":"infra_raidforums_domain_rfws","takedown_reference_id":"td_2022_raidforums","takedown_slug":"operation-tourniquet","kind":"domain","identifier":"rf.ws","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Seized and redirected to a seizure notice."},{"reference_id":"infra_raidforums_domain_raidlol","takedown_reference_id":"td_2022_raidforums","takedown_slug":"operation-tourniquet","kind":"domain","identifier":"raid.lol","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Seized and redirected to a seizure notice."},{"reference_id":"infra_genesis_domains","takedown_reference_id":"td_2023_genesis","takedown_slug":"operation-cookie-monster","kind":"domain","identifier":null,"quantity":11,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Eleven domains seized under a warrant issued in the Eastern District of Wisconsin. Some reporting cites approximately 24 domains; CONFLICTING and not harmonized. Resolved to the official DOJ figure of 11 domains (E.D. Wisconsin warrant); a commonly repeated ~24 figure is not a DOJ number."},{"reference_id":"infra_genesis_servers","takedown_reference_id":"td_2023_genesis","takedown_slug":"operation-cookie-monster","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"US-based servers supporting the marketplace."},{"reference_id":"infra_breachforums_2024_domain","takedown_reference_id":"td_2024_breachforums","takedown_slug":"breachforums-domain-seizure","kind":"domain","identifier":"breachforums.st","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Clearnet domain seized and replaced with a seizure banner. Operators briefly regained control via registrar credentials before losing it again."},{"reference_id":"infra_breachforums_2024_telegram","takedown_reference_id":"td_2024_breachforums","takedown_slug":"breachforums-domain-seizure","kind":"user_account","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Associated Telegram channels taken over by law enforcement."},{"reference_id":"infra_goz_dga_domains","takedown_reference_id":"td_2014_gameover_zeus","takedown_slug":"operation-tovar","kind":"domain","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"sinkholed","country_code":null,"notes":"Domain-generation-algorithm domains registered and sinkholed under court order. Exact count not published in the primary release."},{"reference_id":"infra_goz_p2p","takedown_reference_id":"td_2014_gameover_zeus","takedown_slug":"operation-tovar","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"taken_over","country_code":null,"notes":"Peer-to-peer command-and-control layer poisoned and redirected to law-enforcement-controlled infrastructure."},{"reference_id":"infra_goz_infections","takedown_reference_id":"td_2014_gameover_zeus","takedown_slug":"operation-tovar","kind":"malware_installation","identifier":null,"quantity":500000,"quantity_qualifier":"approximately","action":"sinkholed","country_code":null,"notes":"Estimates range from approximately 500,000 to one million infected machines. Range preserved rather than harmonized."},{"reference_id":"infra_avalanche_domains","takedown_reference_id":"td_2016_avalanche","takedown_slug":"avalanche-network-takedown","kind":"domain","identifier":null,"quantity":800000,"quantity_qualifier":"more_than","action":"sinkholed","country_code":null,"notes":"More than 800,000 domains seized, sinkholed, or blocked. The official figure combines three distinct actions and cannot be decomposed from the public source."},{"reference_id":"infra_avalanche_servers","takedown_reference_id":"td_2016_avalanche","takedown_slug":"avalanche-network-takedown","kind":"server","identifier":null,"quantity":39,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"39 servers seized across participating countries."},{"reference_id":"infra_emotet_c2","takedown_reference_id":"td_2021_emotet","takedown_slug":"operation-ladybird","kind":"command_and_control","identifier":null,"quantity":700,"quantity_qualifier":"approximately","action":"taken_over","country_code":null,"notes":"Approximately 700 command-and-control servers taken over and repurposed to control infected machines."},{"reference_id":"infra_emotet_infections","takedown_reference_id":"td_2021_emotet","takedown_slug":"operation-ladybird","kind":"malware_installation","identifier":null,"quantity":1600000,"quantity_qualifier":"approximately","action":"remediated","country_code":null,"notes":"Infected machines redirected to law-enforcement infrastructure and later served a court-authorized uninstall module triggered 2021-04-25."},{"reference_id":"infra_qakbot_servers","takedown_reference_id":"td_2023_qakbot","takedown_slug":"operation-duck-hunt","kind":"server","identifier":null,"quantity":52,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"52 servers seized as part of the operation."},{"reference_id":"infra_qakbot_infections","takedown_reference_id":"td_2023_qakbot","takedown_slug":"operation-duck-hunt","kind":"malware_installation","identifier":null,"quantity":700000,"quantity_qualifier":"approximately","action":"remediated","country_code":null,"notes":"Approximately 700,000 infected computers received the uninstaller, including roughly 200,000 in the United States."},{"reference_id":"infra_qakbot_crypto","takedown_reference_id":"td_2023_qakbot","takedown_slug":"operation-duck-hunt","kind":"crypto_wallet","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Approximately 8.6 million USD in cryptocurrency seized."},{"reference_id":"infra_911s5_domains","takedown_reference_id":"td_2024_911_s5","takedown_slug":"911-s5-botnet-dismantlement","kind":"domain","identifier":null,"quantity":23,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"23 domains seized as part of the dismantlement."},{"reference_id":"infra_911s5_servers","takedown_reference_id":"td_2024_911_s5","takedown_slug":"911-s5-botnet-dismantlement","kind":"server","identifier":null,"quantity":70,"quantity_qualifier":"more_than","action":"seized","country_code":null,"notes":"More than 70 servers seized."},{"reference_id":"infra_911s5_ips","takedown_reference_id":"td_2024_911_s5","takedown_slug":"911-s5-botnet-dismantlement","kind":"ip_address","identifier":null,"quantity":19000000,"quantity_qualifier":"more_than","action":"disabled","country_code":null,"notes":"More than 19 million unique IP addresses were compromised and used as proxies, including 613,841 in the United States."},{"reference_id":"infra_endgame1_servers","takedown_reference_id":"td_2024_endgame_w1","takedown_slug":"operation-endgame-wave-1","kind":"server","identifier":null,"quantity":100,"quantity_qualifier":"more_than","action":"disabled","country_code":null,"notes":"More than 100 servers taken down or disrupted across participating countries."},{"reference_id":"infra_endgame1_domains","takedown_reference_id":"td_2024_endgame_w1","takedown_slug":"operation-endgame-wave-1","kind":"domain","identifier":null,"quantity":2000,"quantity_qualifier":"more_than","action":"seized","country_code":null,"notes":"More than 2,000 domains brought under law-enforcement control."},{"reference_id":"infra_endgame2_servers","takedown_reference_id":"td_2025_endgame_w2","takedown_slug":"operation-endgame-wave-2","kind":"server","identifier":null,"quantity":300,"quantity_qualifier":"approximately","action":"disabled","country_code":null,"notes":"Approximately 300 servers disrupted worldwide."},{"reference_id":"infra_endgame2_domains","takedown_reference_id":"td_2025_endgame_w2","takedown_slug":"operation-endgame-wave-2","kind":"domain","identifier":null,"quantity":650,"quantity_qualifier":"approximately","action":"seized","country_code":null,"notes":"Approximately 650 domains neutralized."},{"reference_id":"infra_endgame3_servers","takedown_reference_id":"td_2025_endgame_w3","takedown_slug":"operation-endgame-wave-3","kind":"server","identifier":null,"quantity":1000,"quantity_qualifier":"more_than","action":"disabled","country_code":null,"notes":"More than 1,000 servers disrupted."},{"reference_id":"infra_endgame3_domains","takedown_reference_id":"td_2025_endgame_w3","takedown_slug":"operation-endgame-wave-3","kind":"domain","identifier":null,"quantity":20,"quantity_qualifier":"approximately","action":"seized","country_code":null,"notes":"Approximately 20 domains seized."},{"reference_id":"infra_lumma_domains","takedown_reference_id":"td_2025_lumma","takedown_slug":"lumma-stealer-disruption","kind":"domain","identifier":null,"quantity":2300,"quantity_qualifier":"approximately","action":"seized","country_code":"US","notes":"Approximately 2,300 domains forming the backbone of Lumma's infrastructure were seized or redirected to Microsoft sinkholes under a civil court order."},{"reference_id":"infra_lumma_c2","takedown_reference_id":"td_2025_lumma","takedown_slug":"lumma-stealer-disruption","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"DOJ seized the central command structure and the marketplaces where the malware was sold."},{"reference_id":"infra_lumma_infections","takedown_reference_id":"td_2025_lumma","takedown_slug":"lumma-stealer-disruption","kind":"malware_installation","identifier":null,"quantity":394000,"quantity_qualifier":"more_than","action":"sinkholed","country_code":null,"notes":"More than 394,000 infected Windows computers identified globally between 2025-03-16 and 2025-05-16."},{"reference_id":"infra_netwalker_onion","takedown_reference_id":"td_2021_netwalker","takedown_slug":"netwalker-ransomware-disruption","kind":"onion_service","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"BG","notes":"Dark-web resources used for victim communication and data leaks, seized with Bulgarian assistance."},{"reference_id":"infra_netwalker_crypto","takedown_reference_id":"td_2021_netwalker","takedown_slug":"netwalker-ransomware-disruption","kind":"crypto_wallet","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Approximately 454,530 USD in cryptocurrency seized."},{"reference_id":"infra_hive_servers","takedown_reference_id":"td_2023_hive","takedown_slug":"hive-ransomware-infiltration-and-seizure","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Servers seized in Germany and the Netherlands. Exact count not published."},{"reference_id":"infra_hive_leak_site","takedown_reference_id":"td_2023_hive","takedown_slug":"hive-ransomware-infiltration-and-seizure","kind":"onion_service","identifier":null,"quantity":2,"quantity_qualifier":"approximately","action":"seized","country_code":null,"notes":"Leak site and victim payment site seized and replaced with a joint seizure notice."},{"reference_id":"infra_hive_network_access","takedown_reference_id":"td_2023_hive","takedown_slug":"hive-ransomware-infiltration-and-seizure","kind":"admin_panel","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"taken_over","country_code":null,"notes":"FBI held covert access to the Hive network from July 2022, extracting decryption keys for approximately seven months before the seizure."},{"reference_id":"infra_lockbit_servers","takedown_reference_id":"td_2024_cronos_w1","takedown_slug":"operation-cronos-wave-1","kind":"server","identifier":null,"quantity":34,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"34 servers seized across the Netherlands, Germany, Finland, France, Switzerland, Australia, the United Kingdom, and the United States."},{"reference_id":"infra_lockbit_leak_site","takedown_reference_id":"td_2024_cronos_w1","takedown_slug":"operation-cronos-wave-1","kind":"onion_service","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"taken_over","country_code":null,"notes":"Leak site seized and repurposed by the task force to publish information about the group."},{"reference_id":"infra_lockbit_wallets","takedown_reference_id":"td_2024_cronos_w1","takedown_slug":"operation-cronos-wave-1","kind":"crypto_wallet","identifier":null,"quantity":200,"quantity_qualifier":"more_than","action":"frozen","country_code":null,"notes":"More than 200 cryptocurrency wallets linked to the group frozen."},{"reference_id":"infra_lockbit_accounts","takedown_reference_id":"td_2024_cronos_w1","takedown_slug":"operation-cronos-wave-1","kind":"user_account","identifier":null,"quantity":14000,"quantity_qualifier":"approximately","action":"disabled","country_code":null,"notes":"Approximately 14,000 rogue accounts on third-party services used for exfiltration and infrastructure were closed."},{"reference_id":"infra_encrochat_servers","takedown_reference_id":"td_2020_encrochat","takedown_slug":"encrochat-interception-and-shutdown","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"taken_over","country_code":"FR","notes":"France-hosted server infrastructure compromised by a law-enforcement technical implant."},{"reference_id":"infra_encrochat_devices","takedown_reference_id":"td_2020_encrochat","takedown_slug":"encrochat-interception-and-shutdown","kind":"user_account","identifier":null,"quantity":60000,"quantity_qualifier":"approximately","action":"searched","country_code":null,"notes":"Approximately 60,000 users, with more than 100 million messages intercepted."},{"reference_id":"infra_skyecc_traffic","takedown_reference_id":"td_2021_sky_ecc","takedown_slug":"sky-ecc-interception-and-action-day","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"taken_over","country_code":null,"notes":"Encrypted traffic decrypted and monitored by Belgian and Dutch authorities."},{"reference_id":"infra_skyecc_users","takedown_reference_id":"td_2021_sky_ecc","takedown_slug":"sky-ecc-interception-and-action-day","kind":"user_account","identifier":null,"quantity":70000,"quantity_qualifier":"approximately","action":"searched","country_code":null,"notes":"Approximately 70,000 users, with roughly one billion messages unlocked."},{"reference_id":"infra_anom_platform","takedown_reference_id":"td_2021_anom","takedown_slug":"operation-trojan-shield","kind":"command_and_control","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"taken_over","country_code":null,"notes":"The platform was designed and operated by law enforcement from inception rather than seized from an existing operator."},{"reference_id":"infra_anom_devices","takedown_reference_id":"td_2021_anom","takedown_slug":"operation-trojan-shield","kind":"user_account","identifier":null,"quantity":12000,"quantity_qualifier":"approximately","action":"searched","country_code":null,"notes":"Approximately 12,000 devices across more than 300 criminal syndicates; more than 27 million messages collected."},{"reference_id":"infra_wtv_server","takedown_reference_id":"td_2019_welcome_to_video","takedown_slug":"welcome-to-video-seizure","kind":"server","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"KR","notes":"Server seized in South Korea, yielding approximately eight terabytes of material and roughly 250,000 videos."},{"reference_id":"infra_wtv_onion","takedown_reference_id":"td_2019_welcome_to_video","takedown_slug":"welcome-to-video-seizure","kind":"onion_service","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"Hidden service taken offline."},{"reference_id":"infra_webstresser_domain","takedown_reference_id":"td_2018_webstresser","takedown_slug":"webstresser-org-takedown","kind":"domain","identifier":"webstresser.org","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"Domain taken offline and replaced with a seizure notice."},{"reference_id":"infra_webstresser_servers","takedown_reference_id":"td_2018_webstresser","takedown_slug":"webstresser-org-takedown","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Infrastructure seized in the Netherlands, the United States, and Germany."},{"reference_id":"infra_poweroff_2022_domains","takedown_reference_id":"td_2022_poweroff_dec","takedown_slug":"operation-poweroff-december-2022-wave","kind":"domain","identifier":null,"quantity":48,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"48 booter and stresser domains seized and redirected to seizure notices."},{"reference_id":"infra_poweroff_2024_domains","takedown_reference_id":"td_2024_poweroff_dec","takedown_slug":"operation-poweroff-december-2024-wave","kind":"domain","identifier":null,"quantity":27,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"27 DDoS-for-hire platforms taken offline."},{"reference_id":"infra_poweroff_2026_domains","takedown_reference_id":"td_2026_poweroff_apr","takedown_slug":"operation-poweroff-april-2026-wave","kind":"domain","identifier":null,"quantity":53,"quantity_qualifier":"exact","action":"seized","country_code":null,"notes":"53 booter and stresser domains seized across 21 countries."},{"reference_id":"infra_snake_implants","takedown_reference_id":"td_2023_snake","takedown_slug":"operation-medusa","kind":"malware_installation","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"remediated","country_code":null,"notes":"Snake implants commanded to overwrite their own vital components using the FBI-developed PERSEUS tool. Exact implant count not published."},{"reference_id":"infra_snake_p2p","takedown_reference_id":"td_2023_snake","takedown_slug":"operation-medusa","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"disabled","country_code":null,"notes":"Peer-to-peer network used to relay collected data neutralized."},{"reference_id":"infra_kv_routers","takedown_reference_id":"td_2024_kv_botnet","takedown_slug":"kv-botnet-disruption","kind":"malware_installation","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"remediated","country_code":"US","notes":"Malware deleted from hundreds of compromised end-of-life SOHO routers in the United States. Exact count reported as hundreds."},{"reference_id":"infra_kv_c2","takedown_reference_id":"td_2024_kv_botnet","takedown_slug":"kv-botnet-disruption","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"disabled","country_code":null,"notes":"Router connections to the botnet command-and-control severed."},{"reference_id":"infra_raptor_devices","takedown_reference_id":"td_2024_raptor_train","takedown_slug":"raptor-train-botnet-disruption","kind":"malware_installation","identifier":null,"quantity":200000,"quantity_qualifier":"more_than","action":"remediated","country_code":null,"notes":"More than 200,000 consumer devices including routers, IP cameras, DVRs, and network attached storage."},{"reference_id":"infra_raptor_c2","takedown_reference_id":"td_2024_raptor_train","takedown_slug":"raptor-train-botnet-disruption","kind":"command_and_control","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"taken_over","country_code":null,"notes":"Control of the botnet infrastructure seized; an attempted migration by the operators was countered."},{"reference_id":"infra_coreflood_domains","takedown_reference_id":"td_2011_coreflood","takedown_slug":"coreflood-botnet-disruption","kind":"domain","identifier":null,"quantity":29,"quantity_qualifier":"approximately","action":"seized","country_code":"US","notes":"Domains associated with Coreflood C2 infrastructure named in the seizure warrant."},{"reference_id":"infra_dnschanger_servers","takedown_reference_id":"td_2011_dnschanger","takedown_slug":"operation-ghost-click","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Rogue DNS servers seized; clean substitute DNS infrastructure stood up under court order."},{"reference_id":"infra_megaupload_domains","takedown_reference_id":"td_2012_megaupload","takedown_slug":"megaupload-seizure","kind":"domain","identifier":null,"quantity":18,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"18 domains associated with the Megaupload service."},{"reference_id":"infra_citadel_domains","takedown_reference_id":"td_2013_citadel","takedown_slug":"citadel-botnet-disruption","kind":"domain","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Domains/servers associated with over a thousand individual Citadel botnet instances."},{"reference_id":"infra_playpen_server","takedown_reference_id":"td_2015_playpen","takedown_slug":"operation-pacifier-playpen","kind":"server","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"taken_over","country_code":"US","notes":"Tor hidden-service server seized and covertly operated by FBI under warrant before shutdown."},{"reference_id":"infra_darkode_forum","takedown_reference_id":"td_2015_darkode","takedown_slug":"darkode-forum-takedown","kind":"domain","identifier":"darkode.com","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Primary forum domain seized and replaced with a law-enforcement notice."},{"reference_id":"infra_deepdotweb_domain","takedown_reference_id":"td_2019_deepdotweb","takedown_slug":"deepdotweb-domain-seizure","kind":"domain","identifier":"deepdotweb.com","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Primary referral-portal domain seized."},{"reference_id":"infra_weleakinfo_domain","takedown_reference_id":"td_2020_weleakinfo","takedown_slug":"weleakinfo-seizure","kind":"domain","identifier":"weleakinfo.com","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Primary WeLeakInfo domain."},{"reference_id":"infra_vpnfilter_domain","takedown_reference_id":"td_2018_vpnfilter","takedown_slug":"vpnfilter-botnet-disruption","kind":"domain","identifier":null,"quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"Domain used in the VPNFilter C2/reinfection mechanism."},{"reference_id":"infra_chipmixer_servers","takedown_reference_id":"td_2023_chipmixer","takedown_slug":"chipmixer-takedown","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"DE","notes":"Backend server infrastructure seized in Germany."},{"reference_id":"infra_chipmixer_domains","takedown_reference_id":"td_2023_chipmixer","takedown_slug":"chipmixer-takedown","kind":"domain","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":"Domains associated with the ChipMixer service."},{"reference_id":"infra_doublevpn_servers","takedown_reference_id":"td_2021_doublevpn","takedown_slug":"doublevpn-takedown","kind":"server","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":null,"notes":"Servers supporting the DoubleVPN service."},{"reference_id":"infra_lolekhosted_domain","takedown_reference_id":"td_2023_lolekhosted","takedown_slug":"lolekhosted-seizure","kind":"domain","identifier":"LolekHosted.net","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":null},{"reference_id":"infra_heartsender_domains","takedown_reference_id":"td_2025_heartsender","takedown_slug":"heartsender-takedown","kind":"domain","identifier":null,"quantity":39,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":null},{"reference_id":"infra_cfake_socfake_domains","takedown_reference_id":"td_2026_cfake_socfake","takedown_slug":"cfake-com-and-socfake-com-seizure","kind":"domain","identifier":null,"quantity":2,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":"CFAKE.com and SOCFAKE.com domains."},{"reference_id":"infra_kat_domains","takedown_reference_id":"td_2016_kickass_torrents","takedown_slug":"kickass-torrents-takedown","kind":"domain","identifier":null,"quantity":null,"quantity_qualifier":"unknown","action":"seized","country_code":"US","notes":null},{"reference_id":"infra_offsides_domains","takedown_reference_id":"td_2026_operation_offsides","takedown_slug":"operation-offsides-2026-fifa-world-cup-streaming-domains","kind":"domain","identifier":null,"quantity":1000,"quantity_qualifier":"more_than","action":"seized","country_code":"US","notes":"More than 1,000 domains streaming World Cup matches without authorization."},{"reference_id":"infra_backpage_domain","takedown_reference_id":"td_2018_backpage","takedown_slug":"backpage-com-seizure","kind":"domain","identifier":"backpage.com","quantity":1,"quantity_qualifier":"exact","action":"seized","country_code":"US","notes":null}]}