[Back to the takedown index](https://takedownindex.org/takedowns) [Operation PowerOFF](https://takedownindex.org/takedowns/operation-poweroff) # Webstresser.org takedown April 2018, DDoS for hire Led by [Politie (Netherlands National Police)](https://takedownindex.org/organizations/politie-netherlands-national-police), [National Crime Agency](https://takedownindex.org/organizations/national-crime-agency) Verified core entry, last reviewed August 21, 2026 What was taken down? Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? Officials reported 6 apprehended. Group accounted for: Likely complete [See people and accountability](#people) Did it stay down? After this action a successor service took over the same demand, first seen May 2018. The replacement was itself seized in a later action. High confidence in the link between the two. [See what happened afterward](#afterward) ## What happened Dutch and UK-led international action seizing the infrastructure of Webstresser.org, then the world's largest DDoS-for-hire service, with administrator arrests in four countries.[[1]](#source-1)[[2]](#source-2) Announced April 25, 2018. **Date:** April 24 to April 25, 2018 **Target:** Webstresser.org, booter stresser service **Activity:** DDoS for hire **Operational lead:** Dutch National Police and NCA **Partners** Europol[[1]](#source-1) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator **Jurisdiction:** Netherlands, United Kingdom, Croatia, Canada, Serbia, Germany, United States, and European Union **Outcome:** Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice. **Status:** Completed **Legal mechanism:** Dutch and UK judicial process; international arrest warrants; Europol coordination **Group accounted for:** Likely complete ### Infrastructure 1 domain seized. Servers seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | webstresser[.]org | 1 domain | Seized | Domain taken offline and replaced with a seizure notice.[[1]](#source-1) | | Not published | Server | Seized | Infrastructure seized in the Netherlands, the United States, and Germany.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Likely complete The administrative team was reported arrested and the infrastructure seized, though the full roster was not officially confirmed as closed and administrators were not comprehensively named. Six administrators reported arrested across the United Kingdom, Croatia, Canada, and Serbia. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/webstresser-org-takedown/organizations) ## What happened afterward Follow-on measures taken against users of the service in multiple countries.[[1]](#source-1)[[2]](#source-2) May 2018 Replacement booter and stresser services. Ecosystem successor. Confidence: High. Seized in a later action.[[3]](#source-3) The DDoS-for-hire market was repopulated by unrelated operators, prompting the recurring PowerOFF wave structure. [Later action: Operation PowerOFF December 2022 wave](https://takedownindex.org/takedowns/operation-poweroff-december-2022-wave) Return class E. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [World's biggest marketplace selling internet paralysing DDoS attacks taken down](https://takedownindex.org/sources/europol-world-s-biggest-marketplace-selling-internet-paralysing-ddos-attacks-tak) Europol, April 25, 2018, Source grade P2 Infrastructure seizure locations, administrator arrests, service scale No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [NCA statement on the Webstresser takedown](https://takedownindex.org/sources/national-crime-agency-nca-statement-on-the-webstresser-takedown) National Crime Agency, April 25, 2018, Source grade P2 UK role and follow-on action against users No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 3. [Federal Prosecutors in Los Angeles and Alaska Charge 6 Defendants with Operating Websites that Offer Computer Attack Services](https://takedownindex.org/sources/united-states-department-of-justice-federal-prosecutors-in-los-angeles-and-alask) United States Department of Justice, December 14, 2022, Source grade P1 48 domain seizures and six defendants charged No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. The service had roughly 136,000 registered users and had been used in more than four million attacks. Users are a separate population from the six administrators. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Welcome to Video seizure](https://takedownindex.org/takedowns/welcome-to-video-seizure) - [Hansa covert takeover and shutdown](https://takedownindex.org/takedowns/hansa-covert-takeover-and-shutdown) - [WeLeakInfo seizure](https://takedownindex.org/takedowns/weleakinfo-seizure) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)