Skip to main content
Back to the takedown index

Operation PowerOFF

Webstresser.org takedown

April 2018, DDoS for hire
Led by Politie (Netherlands National Police), National Crime Agency

Verified core entry, last reviewed August 21, 2026

What was taken down?

Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.[1][2]

See what happened

What happened to the people?

Officials reported 6 apprehended.
Group accounted for: Likely complete

See people and accountability

Did it stay down?

After this action a successor service took over the same demand, first seen May 2018. The replacement was itself seized in a later action. High confidence in the link between the two.

See what happened afterward

Dutch and UK-led international action seizing the infrastructure of Webstresser.org, then the world's largest DDoS-for-hire service, with administrator arrests in four countries.[1][2]

Announced April 25, 2018.

Date
April 24 to April 25, 2018
Target
Webstresser.org, booter stresser service
Activity
DDoS for hire
Operational lead
Dutch National Police and NCA
Partners
Europol[1]
Jurisdiction
Netherlands, United Kingdom, Croatia, Canada, Serbia, Germany, United States, and European Union
Outcome
Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Status
Completed
Legal mechanism
Dutch and UK judicial process; international arrest warrants; Europol coordination
Group accounted for
Likely complete

Infrastructure

1 domain seized. Servers seized, with no count in the record.

1
domain seized
Identifier Recorded as Status Notes
webstresser[.]org 1 domain Seized Domain taken offline and replaced with a seizure notice.[1]
Not published Server Seized Infrastructure seized in the Netherlands, the United States, and Germany.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Likely complete

The administrative team was reported arrested and the infrastructure seized, though the full roster was not officially confirmed as closed and administrators were not comprehensively named.

Six administrators reported arrested across the United Kingdom, Croatia, Canada, and Serbia.

See the organizations and roles behind this action

Follow-on measures taken against users of the service in multiple countries.[1][2]

  1. May 2018

    Replacement booter and stresser services. Ecosystem successor. Confidence: High. Seized in a later action.[3]

    The DDoS-for-hire market was repopulated by unrelated operators, prompting the recurring PowerOFF wave structure.

    Later action: Operation PowerOFF December 2022 wave

May 2018

Replacement booter and stresser services. Ecosystem successor. Confidence: High. Seized in a later action.[3]

The DDoS-for-hire market was repopulated by unrelated operators, prompting the recurring PowerOFF wave structure.

Later action: Operation PowerOFF December 2022 wave

Return class E. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    World's biggest marketplace selling internet paralysing DDoS attacks taken down

    Europol, April 25, 2018, Source grade P2

    Infrastructure seizure locations, administrator arrests, service scale

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    NCA statement on the Webstresser takedown

    National Crime Agency, April 25, 2018, Source grade P2

    UK role and follow-on action against users

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  3. [3]
    Federal Prosecutors in Los Angeles and Alaska Charge 6 Defendants with Operating Websites that Offer Computer Attack Services

    United States Department of Justice, December 14, 2022, Source grade P1

    48 domain seizures and six defendants charged

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. The service had roughly 136,000 registered users and had been used in more than four million attacks. Users are a separate population from the six administrators.