Skip to main content
Back to the takedown index

Operation PowerOFF

April 2018, DDoS for hire

Verified core entry, last reviewed August 21, 2026

Umbrella campaign. This entry groups 5 recorded actions. Infrastructure, people, and sources sit on each wave rather than on this entry, so read the waves for what was taken down and who was held to account.

Wave Date Lead Outcome
Webstresser.org takedown April 24 to April 25, 2018 Dutch National Police and NCA Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Operation PowerOFF December 2022 wave December 13 to December 14, 2022 FBI 48 domains seized and redirected to seizure notices.
Operation PowerOFF December 2024 wave December 1 to December 11, 2024 Not established 27 platforms taken offline and domains seized.
Operation PowerOFF April 2026 wave April 13 to April 17, 2026 Not established 53 domains seized; more than three million criminal accounts exposed; more than 75,000 warning messages sent to users.
PowerOFF eight-domain action (April 2026, USAO Alaska wave) April 2026 USAO-AK Eight domains seized.

Long-running recurring international campaign against booter and stresser services, executed in distinct dated waves since 2018.[1]

Announced April 25, 2018.

Date
April 2018
Target
DDoS-for-hire ecosystem, campaign
Activity
DDoS for hire
Operational lead
Not established
Jurisdiction
Netherlands, United Kingdom, United States, Germany, Poland, and European Union
Outcome
See child incidents.
Status
Ongoing
Legal mechanism
See child incidents.
Group accounted for
Not applicable

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

Campaign-level record.

Not applicable at campaign level.

Active through the cutoff.[1]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    World's biggest marketplace selling internet paralysing DDoS attacks taken down

    Europol, April 25, 2018, Source grade P2

    Infrastructure seizure locations, administrator arrests, service scale

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • Excluded from incident totals. Children in this pass: td_2018_webstresser, td_2022_poweroff_dec, td_2024_poweroff_dec, td_2026_poweroff_apr.
  • Additional waves in 2019, 2023, and May 2025 were identified but not fully verified in this pass. Recorded as a coverage gap.