Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions
Last reviewed August 20, 2026
Reset filters
Jurisdiction: Canada Clear all filters
Takedown Date Category Lead organization Jurisdiction Status
Operation Endgame wave 2 ID: td_2025_endgame_w2 May 19, 2025 Multi threat campaign BKA International Completed
Operation Cronos wave 1 ID: td_2024_cronos_w1 Feb 19, 2024 Ransomware NCA and FBI International Completed
Operation MEDUSA ID: td_2023_snake May 8, 2023 State sponsored FBI International Completed
NetWalker ransomware disruption ID: td_2021_netwalker Jan 27, 2021 Ransomware FBI International Completed
Operation Ladybird ID: td_2021_emotet Jan 26, 2021 Malware and botnets Dutch National Police and BKA International Completed
Webstresser.org takedown ID: td_2018_webstresser Apr 24, 2018 DDoS for hire Dutch National Police and NCA International Completed
Welcome to Video seizure ID: td_2019_welcome_to_video Mar 5, 2018 Child sexual abuse material IRS-CI and HSI International Completed
AlphaBay seizure ID: td_2017_alphabay Jul 4, 2017 Darknet market FBI and DEA International Completed
Avalanche network takedown ID: td_2016_avalanche Nov 30, 2016 Criminal hosting and proxies Verden Public Prosecutor International Completed

Showing 1 to 9 of 9 takedowns

9 results

May 2025

Operation Endgame

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie Multi threat campaign

Lead
BKA
Result
Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
Accountability
3 charged and 1 publicly wanted
Return status
Not established in the public record

February 2024

Operation Cronos

LockBit Ransomware

Lead
NCA and FBI
Result
34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
Accountability
4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
Return status
Returned under the same operators

May 2023

Operation MEDUSA

Snake malware network State sponsored

Lead
FBI
Result
Snake implants on victim machines disabled by issuing commands that caused the malware to overwrite its own vital components; peer-to-peer network neutralized.
Accountability
No individual outcomes recorded
Return status
Later activity recorded, link to the original not established

January 2021

NetWalker ransomware disruption

NetWalker Ransomware

Lead
FBI
Result
Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.
Accountability
1 charged
Return status
Not established in the public record
Operation Ladybird

Emotet Malware and botnets

Lead
Dutch National Police and BKA
Result
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Accountability
2 apprehended
Return status
Returned on replacement infrastructure

April 2018

Operation PowerOFF

Webstresser.org DDoS for hire

Lead
Dutch National Police and NCA
Result
Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Accountability
6 apprehended
Return status
Followed by a successor service

March 2018

Welcome to Video seizure

Welcome to Video Child sexual abuse material

Lead
IRS-CI and HSI
Result
Server seized in South Korea and site taken offline; approximately eight terabytes of material and roughly 250,000 videos secured; Bitcoin transaction analysis used to identify users.
Accountability
1 charged, 1 apprehended, and 1 convicted
Return status
Later activity recorded, link to the original not established

July 2017

Operation Bayonet

AlphaBay Darknet market

Lead
FBI and DEA
Result
Marketplace servers and hidden service seized; site taken offline; assets and cryptocurrency frozen in multiple jurisdictions.
Accountability
1 charged and 1 apprehended
Return status
Followed by a successor service

November 2016

Avalanche network takedown

Avalanche Criminal hosting and proxies

Lead
Verden Public Prosecutor
Result
More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.
Accountability
5 apprehended
Return status
Later activity recorded, link to the original not established

Previous Page 1 of 1 Next

Filters

Filter takedowns

Clear