More than 1,000 unauthorized World Cup streaming domains Piracy and IP
- Lead
- ICE-HSI and IPR Center
- Result
- More than 1,000 domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
Public record database
Takedown Index
The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.
| Takedown | Date | Category | Lead organization | Jurisdiction | Status Derived from the recorded end date. A date in the past reads Completed, no date reads Ongoing. The dataset carries no separate status column. |
|---|---|---|---|---|---|
| Operation Offsides (2026 FIFA World Cup streaming domains) ID: td_2026_operation_offsides | Jul 20, 2026 | Piracy and IP | ICE-HSI and IPR Center | Not established | Completed |
| Huione Group backend infrastructure seizure ID: td_2026_huione_backend | Jun 23, 2026 | Cryptocurrency laundering | FBI | Not established | Completed |
| CFAKE.com and SOCFAKE.com seizure ID: td_2026_cfake_socfake | Jun 12, 2026 | Child sexual abuse material | HSI | Not established | Completed |
| PowerOFF eight-domain action (April 2026, USAO Alaska wave) ID: td_2026_poweroff_apr_offsides | Apr 16, 2026 | DDoS for hire | USAO-AK | Not established | Completed |
| Operation PowerOFF April 2026 wave ID: td_2026_poweroff_apr | Apr 13, 2026 | DDoS for hire | Not established | International | Completed |
| GRU DNS-hijacking router network disruption (APT28) ID: td_2026_gru_router_network | Apr 1, 2026 | State sponsored | FBI | Not established | Completed |
| Aisuru/KimWolf/JackSkid/Mossad IoT DDoS botnet disruption ID: td_2026_aisuru_family | Mar 19, 2026 | Malware and botnets | USAO-AK and FBI | Not established | Completed |
| LeakBase seizure ID: td_2026_leakbase | Mar 4, 2026 | Fraud and stolen data | FBI | Not established | Completed |
| SocksEscort proxy network disruption ID: td_2026_socksescort | Mar 1, 2026 | Criminal hosting and proxies | FBI | Not established | Completed |
| Red Card 2.0 ID: td_2026_red_card_2 | Feb 18, 2026 | Fraud and stolen data | INTERPOL | Not established | Completed |
| Operation Endgame wave 3 ID: td_2025_endgame_w3 | Nov 10, 2025 | Multi threat campaign | Not established | International | Completed |
| Serengeti 2.0 ID: td_2025_serengeti_2 | Aug 22, 2025 | Fraud and stolen data | INTERPOL and AFRIPOL | Not established | Completed |
| INTERPOL Synergia III ID: td_2026_synergia_iii | Jul 18, 2025 | Multi threat campaign | INTERPOL | Not established | Completed |
| INTERPOL Operation Secure ID: td_2025_operation_secure | Jun 11, 2025 | Malware and botnets | INTERPOL | Not established | Completed |
| Operation Deep Sentinel ID: td_2025_archetyp | Jun 11, 2025 | Darknet market | BKA | International | Completed |
| Operation Endgame wave 2 ID: td_2025_endgame_w2 | May 19, 2025 | Multi threat campaign | BKA | International | Completed |
| Lumma Stealer disruption ID: td_2025_lumma | May 13, 2025 | Malware and botnets | Microsoft DCU and DOJ | International | Completed |
| Operation Stream / Kidflix ID: td_2025_kidflix | Apr 2, 2025 | Child sexual abuse material | BKA | Not established | Completed |
| Garantex disruption ID: td_2025_garantex | Mar 7, 2025 | Cryptocurrency laundering | USSS | Not established | Completed |
| Phobos/8Base ransomware disruption ID: td_2025_phobos_8base | Feb 10, 2025 | Ransomware | Not established | Not established | Completed |
| Cracked and Nulled forums takedown ID: td_2025_cracked_nulled | Jan 30, 2025 | Criminal hosting and proxies | FBI | Not established | Completed |
| HeartSender takedown ID: td_2025_heartsender | Jan 30, 2025 | Fraud and stolen data | FBI | Not established | Completed |
| BreachForums portal seizure (2025) ID: td_2025_breachforums | Jan 1, 2025 | Fraud and stolen data | Not established | International | Ongoing |
| Matrix encrypted messaging service takedown ID: td_2024_matrix | Dec 3, 2024 | Criminal communications | French Gendarmerie and Dutch National Police | Not established | Completed |
| Operation PowerOFF December 2024 wave ID: td_2024_poweroff_dec | Dec 1, 2024 | DDoS for hire | Not established | International | Completed |
Showing 1 to 25 of 104 takedowns
104 results
July 2026
June 2026
Huione Group money-laundering backend Cryptocurrency laundering
- Lead
- FBI
- Result
- Cloud-computing account and associated backend infrastructure seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
CFAKE.com and SOCFAKE.com Child sexual abuse material
- Lead
- HSI
- Result
- Domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
April 2026
Eight DDoS-for-hire booter domains DDoS for hire
- Lead
- USAO-AK
- Result
- Eight domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
53 booter and stresser domains DDoS for hire
- Lead
- Not established
- Result
- 53 domains seized; more than three million criminal accounts exposed; more than 75,000 warning messages sent to users.
- Accountability
- 4 apprehended
- Return status
- Not established in the public record
GRU Military Unit 26165 SOHO router network State sponsored
- Lead
- FBI
- Result
- US-based component of the router network neutralized; operation explicitly limited to infrastructure within US judicial reach.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
March 2026
Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets Malware and botnets
- Lead
- USAO-AK and FBI
- Result
- C2 infrastructure disrupted across multiple related botnet families.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
LeakBase Fraud and stolen data
- Lead
- FBI
- Result
- Site infrastructure and database seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
SocksEscort Criminal hosting and proxies
- Lead
- FBI
- Result
- Several dozen domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
February 2026
Cross-border online fraud infrastructure Fraud and stolen data
- Lead
- INTERPOL
- Result
- Fraud-related infrastructure disrupted across participating countries.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
November 2025
Rhadamanthys, VenomRAT, Elysium botnet Multi threat campaign
- Lead
- Not established
- Result
- More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
- Accountability
- 1 apprehended
- Return status
- Not established in the public record
August 2025
Fraud infrastructure across 18 African countries Fraud and stolen data
- Lead
- INTERPOL and AFRIPOL
- Result
- More than 11,000 malicious infrastructures disrupted.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
July 2025
Heterogeneous malicious infrastructure Multi threat campaign
- Lead
- INTERPOL
- Result
- Approximately 45,000 malicious IPs targeted for disruption or takedown across the campaign period.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
June 2025
Infostealer malware infrastructure (26-country action) Malware and botnets
- Lead
- INTERPOL
- Result
- More than 20,000 malicious IPs/domains taken down; 41 servers seized.
- Accountability
- 32 apprehended
- Return status
- Not established in the public record
Archetyp Market Darknet market
- Lead
- BKA
- Result
- Server infrastructure seized by Dutch police; marketplace taken offline and replaced with seizure notice; approximately 7.8 million EUR in assets seized.
- Accountability
- 8 apprehended
- Return status
- Later activity recorded, link to the original not established
May 2025
DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie Multi threat campaign
- Lead
- BKA
- Result
- Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
- Accountability
- 3 charged and 1 publicly wanted
- Return status
- Not established in the public record
Lumma Stealer Malware and botnets
- Lead
- Microsoft DCU and DOJ
- Result
- Approximately 2,300 malicious domains seized or redirected to Microsoft sinkholes; DOJ seized the central command structure and marketplaces selling the malware; European and Japanese infrastructure suspended.
- Accountability
- No individual outcomes recorded
- Return status
- Returned under the same operators
April 2025
Kidflix Child sexual abuse material
- Lead
- BKA
- Result
- Server infrastructure and extensive evidentiary material seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
March 2025
Garantex Cryptocurrency laundering
- Lead
- USSS
- Result
- Domains seized by US authorities; parallel infrastructure/fund actions in Germany and Finland.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
February 2025
Phobos and 8Base Ransomware
- Lead
- Not established
- Result
- More than 100 servers disrupted.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
January 2025
Cracked and Nulled Criminal hosting and proxies
- Lead
- FBI
- Result
- Forum infrastructure seized; sites taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
HeartSender ("Saim Raza") Fraud and stolen data
- Lead
- FBI
- Result
- 39 domains and associated servers seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
BreachForums (further reconstituted) Fraud and stolen data
- Lead
- Not established
- Result
- Portal infrastructure seized and replaced with a law-enforcement notice.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
December 2024
Matrix Criminal communications
- Lead
- French Gendarmerie and Dutch National Police
- Result
- Server infrastructure seized; service taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
27 booter and stresser platforms DDoS for hire
- Lead
- Not established
- Result
- 27 platforms taken offline and domains seized.
- Accountability
- 3 apprehended
- Return status
- Not established in the public record
Filters
Filter takedowns