[Back to the takedown index](https://takedownindex.org/takedowns) # Avalanche network takedown November 2016, Criminal hosting and proxies Led by [Staatsanwaltschaft Verden](https://takedownindex.org/organizations/staatsanwaltschaft-verden) Verified core entry, last reviewed August 21, 2026 What was taken down? More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) [See what happened](#what-happened) What happened to the people? Officials reported 5 apprehended. Group accounted for: Partial [See people and accountability](#people) Did it stay down? After this action later activity was recorded, though its link to the original is not established. Medium confidence in the link between the two. [See what happened afterward](#afterward) ## What happened German-led international operation dismantling the Avalanche double fast-flux network, which provided delivery and command-and-control infrastructure for at least 17 malware families.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Announced December 1, 2016. **Date:** November 2016 **Target:** Avalanche, bulletproof fast flux infrastructure **Activity:** Criminal hosting and proxies, Malware and botnets, Ransomware, Fraud and stolen data **Operational lead:** Verden Public Prosecutor **Partners** Europol, Eurojust, and 2 more[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [European Union Agency for Criminal Justice Cooperation](https://takedownindex.org/organizations/european-union-agency-for-criminal-justice-cooperation), judicial cooperation - [The Shadowserver Foundation](https://takedownindex.org/organizations/the-shadowserver-foundation), technical partner - [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), supporting **Jurisdiction:** Germany, United States, Canada, European Union, and Ukraine **Outcome:** More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched. **Status:** Completed **Legal mechanism:** German judicial orders (Verden Public Prosecutor's Office); coordinated domain actions with registries and registrars across many TLDs; Europol and Eurojust coordination **Group accounted for:** Partial ### Infrastructure 800,000 domains sinkholed and 39 servers seized. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | more than 800,000 domains | Sinkholed | More than 800,000 domains seized, sinkholed, or blocked. The official figure combines three distinct actions and cannot be decomposed from the public source.[[1]](#source-1) | | Not published | 39 servers | Seized | 39 servers seized across participating countries.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Partial Five arrests were officially reported but no core operator roster was published, and the service supported numerous independent criminal groups that were unaffected. Operator group behind the hosting infrastructure was never publicly enumerated; the platform served many unrelated criminal customers. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/avalanche-network-takedown/organizations) ## What happened afterward Sinkhole operation maintained by Shadowserver for years afterward for victim notification.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Date not established No documented return. Relationship not established. Confidence: Medium. Not established.[[1]](#source-1) No affirmative evidence of the Avalanche fast-flux infrastructure being reconstituted was found. The malware families it hosted continued independently. Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. ['Avalanche' network dismantled in international cyber operation](https://takedownindex.org/sources/europol-avalanche-network-dismantled-in-international-cyber-operation) Europol, December 1, 2016, Source grade P2 Domain, server, arrest, and search figures; participating organizations and roles No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [US Department of Justice statement on the Avalanche network takedown](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-statement-on-the-av) United States Department of Justice, December 1, 2016, Source grade P2 US participation in the disruption No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. ### Additional reporting and technical analysis 1. [Shadowserver Foundation account of the Avalanche sinkhole operation](https://takedownindex.org/sources/the-shadowserver-foundation-shadowserver-foundation-account-of-the-avalanche-sin) The Shadowserver Foundation, December 1, 2016, Source grade T1 Sinkhole operation and long-running victim notification No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - Official figures: more than 800,000 domains seized, sinkholed, or blocked; five arrests; 37 premises searched; 39 servers seized. - Roughly 500,000 infected devices per day is a victim-side figure and not an operator count. - Domain quantity is recorded as an aggregate infrastructure item because individual domains were not published. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Darkode forum takedown](https://takedownindex.org/takedowns/darkode-forum-takedown) - [DeepDotWeb domain seizure](https://takedownindex.org/takedowns/deepdotweb-domain-seizure) - [Safe-Inet / Insorg VPN takedown](https://takedownindex.org/takedowns/safe-inet-insorg-vpn-takedown) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)