Skip to main content
Back to the takedown index

Avalanche network takedown

November 2016, Criminal hosting and proxies
Led by Staatsanwaltschaft Verden

Verified core entry, last reviewed August 21, 2026

What was taken down?

More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.[1][2][3]

See what happened

What happened to the people?

Officials reported 5 apprehended.
Group accounted for: Partial

See people and accountability

Did it stay down?

After this action later activity was recorded, though its link to the original is not established. Medium confidence in the link between the two.

See what happened afterward

German-led international operation dismantling the Avalanche double fast-flux network, which provided delivery and command-and-control infrastructure for at least 17 malware families.[1][2][3]

Announced December 1, 2016.

Date
November 2016
Target
Avalanche, bulletproof fast flux infrastructure
Activity
Criminal hosting and proxies, Malware and botnets, Ransomware, Fraud and stolen data
Operational lead
Verden Public Prosecutor
Partners
Europol, Eurojust, and 2 more[1][2][3]
Jurisdiction
Germany, United States, Canada, European Union, and Ukraine
Outcome
More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.
Status
Completed
Legal mechanism
German judicial orders (Verden Public Prosecutor's Office); coordinated domain actions with registries and registrars across many TLDs; Europol and Eurojust coordination
Group accounted for
Partial

Infrastructure

800,000 domains sinkholed and 39 servers seized.

more than 800,000
domains sinkholed
39
servers seized
Identifier Recorded as Status Notes
Not published more than 800,000 domains Sinkholed More than 800,000 domains seized, sinkholed, or blocked. The official figure combines three distinct actions and cannot be decomposed from the public source.[1]
Not published 39 servers Seized 39 servers seized across participating countries.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Five arrests were officially reported but no core operator roster was published, and the service supported numerous independent criminal groups that were unaffected.

Operator group behind the hosting infrastructure was never publicly enumerated; the platform served many unrelated criminal customers.

See the organizations and roles behind this action

Sinkhole operation maintained by Shadowserver for years afterward for victim notification.[1][2][3]

  1. Date not established

    No documented return. Relationship not established. Confidence: Medium. Not established.[1]

    No affirmative evidence of the Avalanche fast-flux infrastructure being reconstituted was found. The malware families it hosted continued independently.

Date not established

No documented return. Relationship not established. Confidence: Medium. Not established.[1]

No affirmative evidence of the Avalanche fast-flux infrastructure being reconstituted was found. The malware families it hosted continued independently.

Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    'Avalanche' network dismantled in international cyber operation

    Europol, December 1, 2016, Source grade P2

    Domain, server, arrest, and search figures; participating organizations and roles

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    US Department of Justice statement on the Avalanche network takedown

    United States Department of Justice, December 1, 2016, Source grade P2

    US participation in the disruption

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Additional reporting and technical analysis

  1. [3]
    Shadowserver Foundation account of the Avalanche sinkhole operation

    The Shadowserver Foundation, December 1, 2016, Source grade T1

    Sinkhole operation and long-running victim notification

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • Official figures: more than 800,000 domains seized, sinkholed, or blocked; five arrests; 37 premises searched; 39 servers seized.
  • Roughly 500,000 infected devices per day is a victim-side figure and not an operator count.
  • Domain quantity is recorded as an aggregate infrastructure item because individual domains were not published.