Public record database # Sources The Internet Takedown Index is built from law enforcement releases, prosecutor and court records, government and agency publications, company reports, and news coverage. Every entry in the index traces back to one of the documents listed here. 152 sources indexed Cited 575 times across the index 137 official documents Government, prosecutor, court, and agency records Research cutoff August 20, 2026 4 of the 152 sources carry a recorded web address. The rest give publisher, title, and date so the document can be retrieved from the publisher. - [All sources](https://takedownindex.org/sources) - [Official documents](https://takedownindex.org/sources?view=official) Showing 1 to 25 of 152 sources | Source | Type | Description | Publisher | Quality | Used in entries | Open source record | | --- | --- | --- | --- | --- | --- | --- | | [Operation Offsides: DOJ seizes domains streaming World Cup matches without authorization](https://takedownindex.org/sources/us-doj-ice-hsi-operation-offsides-doj-seizes-domains-streaming-world-cup-matches) | Prosecutor release | Establishes the seizure of more than 1,000 unauthorized World Cup streaming domains. | US DOJ / ICE HSI | P1 | 3 | | [DOJ seizes cloud infrastructure behind Huione Group money-laundering backend](https://takedownindex.org/sources/us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back) | Prosecutor release | Establishes the seizure of a Huione Group-linked cloud-computing backend account. | US DOJ | P1 | 2 | | [HSI seizes domains behind non-consensual sexual deepfake services](https://takedownindex.org/sources/us-hsi-doj-hsi-seizes-domains-behind-non-consensual-sexual-deepfake-services) | Law enforcement release | Establishes the HSI-led seizure of CFAKE.com and SOCFAKE.com. | US HSI / DOJ | P1 | 2 | | [Europol statement on the April 2026 Operation PowerOFF wave](https://takedownindex.org/sources/europol-europol-statement-on-the-april-2026-operation-poweroff-wave) | International agency release | 53 domains seized, four arrests, 21 participating countries | Europol | P2 | 3 | | [PowerOFF: eight DDoS-for-hire domains seized](https://takedownindex.org/sources/usao-alaska-poweroff-eight-ddos-for-hire-domains-seized) | Prosecutor release | Establishes an eight-domain PowerOFF seizure attributed to USAO Alaska in April 2026. | USAO Alaska | S2 | 1 | | [DOJ disrupts GRU Unit 26165 DNS-hijacking router network](https://takedownindex.org/sources/us-doj-doj-disrupts-gru-unit-26165-dns-hijacking-router-network) | Prosecutor release | Establishes the court-authorized neutralization of the US-based portion of the GRU router network. | US DOJ | P1 | 2 | | [Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets](https://takedownindex.org/sources/usao-alaska-us-doj-coordinated-disruption-of-aisuru-kimwolf-jackskid-and-mossad-) | Prosecutor release | Establishes the multi-country disruption of the four related IoT DDoS botnet families. | USAO Alaska / US DOJ | S2 | 5 | | [INTERPOL Synergia III: 72 countries target 45,000 malicious IPs](https://takedownindex.org/sources/interpol-interpol-synergia-iii-72-countries-target-45-000-malicious-ips) | International agency release | Establishes the campaign's duration, 72-country participation, and 45,000 malicious IP target. | INTERPOL | P2 | 1 | | [LeakBase stolen-data marketplace seized](https://takedownindex.org/sources/us-doj-fbi-leakbase-stolen-data-marketplace-seized) | Prosecutor release | Establishes the LeakBase seizure and evidentiary preservation of user data. | US DOJ / FBI | P1 | 1 | | [SocksEscort residential proxy network disrupted](https://takedownindex.org/sources/us-doj-socksescort-residential-proxy-network-disrupted) | Prosecutor release | Establishes the seizure of dozens of SocksEscort domains. | US DOJ | P1 | 2 | | [Operation Red Card 2.0 targets cross-border online fraud](https://takedownindex.org/sources/interpol-operation-red-card-2-0-targets-cross-border-online-fraud) | International agency release | Establishes the INTERPOL-coordinated Red Card 2.0 action against fraud infrastructure. | INTERPOL | P2 | 1 | | [Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium](https://takedownindex.org/sources/europol-europol-release-on-the-november-2025-operation-endgame-action-against-rh) | International agency release | Wave 3 infrastructure figures and the Greek arrest | Europol | P2 | 5 | | [BreachForums hacking forum admin resentenced to three years in prison](https://takedownindex.org/sources/bleepingcomputer-breachforums-hacking-forum-admin-resentenced-to-three-years-in-) | News report | Fourth Circuit vacatur of the original sentence and Fitzpatrick's 2025-09-16 resentencing to 36 months custody plus 20 years supervised release. | BleepingComputer | S1 | 1 | | [Operation Serengeti 2.0 disrupts over 11,000 malicious cyber infrastructures in Africa](https://takedownindex.org/sources/interpol-afripol-operation-serengeti-2-0-disrupts-over-11-000-malicious-cyber-in) | International agency release | Establishes the 18-country-plus-UK scope and 11,000+ malicious infrastructures figure. | INTERPOL / AFRIPOL | P2 | 2 | | [Bundeskriminalamt statement on Operation Deep Sentinel](https://takedownindex.org/sources/bundeskriminalamt-bundeskriminalamt-statement-on-operation-deep-sentinel) | Law enforcement release | German lead role, arrests, seizure details | Bundeskriminalamt | P1 | 1 | | [Europol release on the takedown of Archetyp Market](https://takedownindex.org/sources/europol-europol-release-on-the-takedown-of-archetyp-market) | International agency release | Operation dates, participating agencies and roles, arrests, asset seizure, marketplace scale | Europol | P2 | 11 | | [Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains](https://takedownindex.org/sources/interpol-operation-secure-interpol-coordinated-action-takes-down-20-000-maliciou) | International agency release | Establishes the 26-country scope, 20,000+ IP/domain figure, 41 servers seized, and 32 arrests. | INTERPOL | P2 | 1 | | [Europol release on Operation Endgame's 2025 action against initial access malware](https://takedownindex.org/sources/europol-europol-release-on-operation-endgame-s-2025-action-against-initial-acces) | International agency release | Wave 2 infrastructure figures, charges, cryptocurrency seizures | Europol | P2 | 5 | | [16 defendants federally charged in connection with DanaBot malware scheme](https://takedownindex.org/sources/usao-central-district-of-california-16-defendants-federally-charged-in-connectio) | Prosecutor release | Names lead defendants Aleksandr Stepanov ('JimmBee') and Artem Kalinkin ('Onix') among 16 charged in the DanaBot scheme (part of Operation Endgame wave 2). | USAO Central District of California | P1 | 2 | | [Lumma Stealer operators register replacement domains within a day of seizure](https://takedownindex.org/sources/aggregated-security-reporting-lumma-stealer-operators-register-replacement-domai) | News report | Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized. | Aggregated security reporting | S1 | 1 | | [United States v. Aleksandr Stepanov et al., DanaBot indictment](https://takedownindex.org/sources/united-states-district-court-for-the-central-district-of-california-united-state) | Indictment | 16-defendant DanaBot charges announced with the Endgame wave | United States District Court for the Central District of California | P0 | 2 | | [US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-announcement-chargi) | Government release | Gallyamov charge, continued operation after the 2023 takedown | United States Department of Justice | P1 | 5 | | [Europol statement on the Lumma Stealer disruption](https://takedownindex.org/sources/europol-europol-statement-on-the-lumma-stealer-disruption) | International agency release | Suspension of Europe-based infrastructure | Europol | P2 | 2 | | [US Department of Justice statement on the seizure of Lumma Stealer command infrastructure](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-statement-on-the-se) | Government release | Seizure of the central command structure and the marketplaces selling the malware | United States Department of Justice | P1 | 3 | | [Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool](https://takedownindex.org/sources/microsoft-on-the-issues-disrupting-lumma-stealer-microsoft-leads-global-action-a) | Participating company report | Court order, approximately 2,300 domains seized, more than 394,000 infected computers identified between 2025-03-16 and 2025-05-16, partner roles | Microsoft On the Issues | T1 | 8 | - [Operation Offsides: DOJ seizes domains streaming World Cup matches without authorization](https://takedownindex.org/sources/us-doj-ice-hsi-operation-offsides-doj-seizes-domains-streaming-world-cup-matches) US DOJ / ICE HSI, July 20, 2026 Establishes the seizure of more than 1,000 unauthorized World Cup streaming domains. Prosecutor release P1Used in 3 entries - [DOJ seizes cloud infrastructure behind Huione Group money-laundering backend](https://takedownindex.org/sources/us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back) US DOJ, June 23, 2026 Establishes the seizure of a Huione Group-linked cloud-computing backend account. Prosecutor release P1Used in 2 entries - [HSI seizes domains behind non-consensual sexual deepfake services](https://takedownindex.org/sources/us-hsi-doj-hsi-seizes-domains-behind-non-consensual-sexual-deepfake-services) US HSI / DOJ, June 12, 2026 Establishes the HSI-led seizure of CFAKE.com and SOCFAKE.com. Law enforcement release P1Used in 2 entries - [Europol statement on the April 2026 Operation PowerOFF wave](https://takedownindex.org/sources/europol-europol-statement-on-the-april-2026-operation-poweroff-wave) Europol, April 17, 2026 53 domains seized, four arrests, 21 participating countries International agency release P2Used in 3 entries - [PowerOFF: eight DDoS-for-hire domains seized](https://takedownindex.org/sources/usao-alaska-poweroff-eight-ddos-for-hire-domains-seized) USAO Alaska, April 16, 2026 Establishes an eight-domain PowerOFF seizure attributed to USAO Alaska in April 2026. Prosecutor release S2Used in 1 entry - [DOJ disrupts GRU Unit 26165 DNS-hijacking router network](https://takedownindex.org/sources/us-doj-doj-disrupts-gru-unit-26165-dns-hijacking-router-network) US DOJ, April 1, 2026 Establishes the court-authorized neutralization of the US-based portion of the GRU router network. Prosecutor release P1Used in 2 entries - [Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets](https://takedownindex.org/sources/usao-alaska-us-doj-coordinated-disruption-of-aisuru-kimwolf-jackskid-and-mossad-) USAO Alaska / US DOJ, March 19, 2026 Establishes the multi-country disruption of the four related IoT DDoS botnet families. Prosecutor release S2Used in 5 entries - [INTERPOL Synergia III: 72 countries target 45,000 malicious IPs](https://takedownindex.org/sources/interpol-interpol-synergia-iii-72-countries-target-45-000-malicious-ips) INTERPOL, March 13, 2026 Establishes the campaign's duration, 72-country participation, and 45,000 malicious IP target. International agency release P2Used in 1 entry - [LeakBase stolen-data marketplace seized](https://takedownindex.org/sources/us-doj-fbi-leakbase-stolen-data-marketplace-seized) US DOJ / FBI, March 4, 2026 Establishes the LeakBase seizure and evidentiary preservation of user data. Prosecutor release P1Used in 1 entry - [SocksEscort residential proxy network disrupted](https://takedownindex.org/sources/us-doj-socksescort-residential-proxy-network-disrupted) US DOJ, March 1, 2026 Establishes the seizure of dozens of SocksEscort domains. Prosecutor release P1Used in 2 entries - [Operation Red Card 2.0 targets cross-border online fraud](https://takedownindex.org/sources/interpol-operation-red-card-2-0-targets-cross-border-online-fraud) INTERPOL, February 18, 2026 Establishes the INTERPOL-coordinated Red Card 2.0 action against fraud infrastructure. International agency release P2Used in 1 entry - [Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium](https://takedownindex.org/sources/europol-europol-release-on-the-november-2025-operation-endgame-action-against-rh) Europol, November 14, 2025 Wave 3 infrastructure figures and the Greek arrest International agency release P2Used in 5 entries - [BreachForums hacking forum admin resentenced to three years in prison](https://takedownindex.org/sources/bleepingcomputer-breachforums-hacking-forum-admin-resentenced-to-three-years-in-) BleepingComputer, September 16, 2025 Fourth Circuit vacatur of the original sentence and Fitzpatrick's 2025-09-16 resentencing to 36 months custody plus 20 years supervised release. News report S1Used in 1 entry - [Operation Serengeti 2.0 disrupts over 11,000 malicious cyber infrastructures in Africa](https://takedownindex.org/sources/interpol-afripol-operation-serengeti-2-0-disrupts-over-11-000-malicious-cyber-in) INTERPOL / AFRIPOL, August 22, 2025 Establishes the 18-country-plus-UK scope and 11,000+ malicious infrastructures figure. International agency release P2Used in 2 entries - [Bundeskriminalamt statement on Operation Deep Sentinel](https://takedownindex.org/sources/bundeskriminalamt-bundeskriminalamt-statement-on-operation-deep-sentinel) Bundeskriminalamt, June 16, 2025 German lead role, arrests, seizure details Law enforcement release P1Used in 1 entry - [Europol release on the takedown of Archetyp Market](https://takedownindex.org/sources/europol-europol-release-on-the-takedown-of-archetyp-market) Europol, June 16, 2025 Operation dates, participating agencies and roles, arrests, asset seizure, marketplace scale International agency release P2Used in 11 entries - [Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains](https://takedownindex.org/sources/interpol-operation-secure-interpol-coordinated-action-takes-down-20-000-maliciou) INTERPOL, June 11, 2025 Establishes the 26-country scope, 20,000+ IP/domain figure, 41 servers seized, and 32 arrests. International agency release P2Used in 1 entry - [Europol release on Operation Endgame's 2025 action against initial access malware](https://takedownindex.org/sources/europol-europol-release-on-operation-endgame-s-2025-action-against-initial-acces) Europol, May 23, 2025 Wave 2 infrastructure figures, charges, cryptocurrency seizures International agency release P2Used in 5 entries - [16 defendants federally charged in connection with DanaBot malware scheme](https://takedownindex.org/sources/usao-central-district-of-california-16-defendants-federally-charged-in-connectio) USAO Central District of California, May 22, 2025 Names lead defendants Aleksandr Stepanov ('JimmBee') and Artem Kalinkin ('Onix') among 16 charged in the DanaBot scheme (part of Operation Endgame wave 2). Prosecutor release P1Used in 2 entries - [Lumma Stealer operators register replacement domains within a day of seizure](https://takedownindex.org/sources/aggregated-security-reporting-lumma-stealer-operators-register-replacement-domai) Aggregated security reporting, May 22, 2025 Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized. News report S1Used in 1 entry - [United States v. Aleksandr Stepanov et al., DanaBot indictment](https://takedownindex.org/sources/united-states-district-court-for-the-central-district-of-california-united-state) United States District Court for the Central District of California, May 22, 2025 16-defendant DanaBot charges announced with the Endgame wave Indictment P0Used in 2 entries - [US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-announcement-chargi) United States Department of Justice, May 22, 2025 Gallyamov charge, continued operation after the 2023 takedown Government release P1Used in 5 entries - [Europol statement on the Lumma Stealer disruption](https://takedownindex.org/sources/europol-europol-statement-on-the-lumma-stealer-disruption) Europol, May 21, 2025 Suspension of Europe-based infrastructure International agency release P2Used in 2 entries - [US Department of Justice statement on the seizure of Lumma Stealer command infrastructure](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-statement-on-the-se) United States Department of Justice, May 21, 2025 Seizure of the central command structure and the marketplaces selling the malware Government release P1Used in 3 entries - [Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool](https://takedownindex.org/sources/microsoft-on-the-issues-disrupting-lumma-stealer-microsoft-leads-global-action-a) Microsoft On the Issues, May 21, 2025 Court order, approximately 2,300 domains seized, more than 394,000 infected computers identified between 2025-03-16 and 2025-05-16, partner roles Participating company report T1Used in 8 entries Showing 1 to 25 of 152 sources