[Back to the takedown index](https://takedownindex.org/takedowns)

# Operation Ghost Click

November 2011, Malware and botnets
Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation)

Extended pass entry, last reviewed August 21, 2026

What was taken down?

FBI seized rogue DNS servers and, with court authorization, substituted clean DNS servers to keep previously infected machines online during remediation.

[See what happened](#what-happened)

What happened to the people?

Officials reported 6 charged and 1 apprehended.
Group accounted for: Partial

[See people and accountability](#people)

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

[See what happened afterward](#afterward)

## What happened

FBI-led operation dismantled a rogue-DNS botnet that had redirected infected computers to fraudulent advertising infrastructure; six Estonian nationals were charged.

**Date:** November 2011

**Target:** DNSChanger, botnet

**Activity:** Malware and botnets

**Operational lead:** FBI

**Partners**

USAO-SDNY[[1]](#source-1)

- [United States Attorney's Office for the Southern District of New York](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-southern-district-of-new-york), prosecuting

**Jurisdiction:** Not established

**Outcome:** FBI seized rogue DNS servers and, with court authorization, substituted clean DNS servers to keep previously infected machines online during remediation.

**Status:** Completed

**Legal mechanism:** Criminal complaint (SDNY); court-authorized substitute DNS infrastructure

**Group accounted for:** Partial

### Infrastructure

Servers seized, with no count in the record.

| Identifier | Recorded as | Status | Notes |
| --- | --- | --- | --- |
| Not published | Server | Seized, United States | Rogue DNS servers seized; clean substitute DNS infrastructure stood up under court order.[[1]](#source-1) |

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Six defendants charged; only one (based in the US at the time) was reported apprehended promptly, with others pursued through Estonian authorities.

[See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-ghost-click/organizations)

## What happened afterward

Not established in the public record. No later activity is recorded against this entry.

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### Official sources

1.
[Operation Ghost Click / DNSChanger case announcement](https://takedownindex.org/sources/fbi-usao-sdny-operation-ghost-click-dnschanger-case-announcement)

FBI / USAO SDNY, November 8, 2011, Source grade S2

Establishes the DNSChanger seizure, substitute-DNS remediation, and the six-defendant indictment.

No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass (reports covering ~75-78 worldwide incidents). Not independently re-verified source-by-source in the same manner as the original 38-incident core; source\_quality is capped at S2/P2 pending a dedicated verification pass, per the project's own recommended-next-steps methodology.

Research context

## How this entry was checked

This entry came from a broader aggregation pass and has not been independently verified source by source. Its sources are graded no higher than P2 or S2, and most carry no address yet. Treat the figures as a research lead rather than a settled record.

Source review: Extended pass, not yet verified

Sources cited: 1

Research cutoff: August 20, 2026

Last reviewed August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [Megaupload seizure](https://takedownindex.org/takedowns/megaupload-seizure)
- [Coreflood botnet disruption](https://takedownindex.org/takedowns/coreflood-botnet-disruption)
- [Citadel botnet disruption](https://takedownindex.org/takedowns/citadel-botnet-disruption)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about#corrections-and-updates)