Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions
Last reviewed August 20, 2026
Reset filters
Jurisdiction: Germany Clear all filters
Takedown Date Category Lead organization Jurisdiction Status
Operation Endgame wave 3 ID: td_2025_endgame_w3 Nov 10, 2025 Multi threat campaign Not established International Completed
Operation Deep Sentinel ID: td_2025_archetyp Jun 11, 2025 Darknet market BKA International Completed
Operation Endgame wave 2 ID: td_2025_endgame_w2 May 19, 2025 Multi threat campaign BKA International Completed
Operation PowerOFF December 2024 wave ID: td_2024_poweroff_dec Dec 1, 2024 DDoS for hire Not established International Completed
Operation Endgame wave 1 ID: td_2024_endgame_w1 May 27, 2024 Multi threat campaign French Gendarmerie, BKA, and Dutch National Police International Completed
911 S5 botnet dismantlement ID: td_2024_911_s5 May 24, 2024 Malware and botnets FBI International Completed
Operation Cronos wave 1 ID: td_2024_cronos_w1 Feb 19, 2024 Ransomware NCA and FBI International Completed
Operation Duck Hunt ID: td_2023_qakbot Aug 25, 2023 Malware and botnets FBI International Completed
Hive ransomware infiltration and seizure ID: td_2023_hive Jul 1, 2022 Ransomware FBI International Completed
Hydra Market server seizure ID: td_2022_hydra Apr 5, 2022 Darknet market BKA International Completed
Operation Ladybird ID: td_2021_emotet Jan 26, 2021 Malware and botnets Dutch National Police and BKA International Completed
Operation Trojan Shield ID: td_2021_anom Oct 1, 2018 Criminal communications FBI and AFP International Completed
Webstresser.org takedown ID: td_2018_webstresser Apr 24, 2018 DDoS for hire Dutch National Police and NCA International Completed
Welcome to Video seizure ID: td_2019_welcome_to_video Mar 5, 2018 Child sexual abuse material IRS-CI and HSI International Completed
Hansa covert takeover and shutdown ID: td_2017_hansa Jun 20, 2017 Darknet market Dutch National Police International Completed
Avalanche network takedown ID: td_2016_avalanche Nov 30, 2016 Criminal hosting and proxies Verden Public Prosecutor International Completed
Operation Onymous ID: td_2014_operation_onymous Nov 5, 2014 Darknet market FBI International Completed
Operation Tovar ID: td_2014_gameover_zeus May 30, 2014 Malware and botnets FBI and NCA International Completed

Showing 1 to 18 of 18 takedowns

18 results

November 2025

Operation Endgame

Rhadamanthys, VenomRAT, Elysium botnet Multi threat campaign

Lead
Not established
Result
More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
Accountability
1 apprehended
Return status
Not established in the public record

June 2025

Operation Deep Sentinel

Archetyp Market Darknet market

Lead
BKA
Result
Server infrastructure seized by Dutch police; marketplace taken offline and replaced with seizure notice; approximately 7.8 million EUR in assets seized.
Accountability
8 apprehended
Return status
Later activity recorded, link to the original not established

May 2025

Operation Endgame

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie Multi threat campaign

Lead
BKA
Result
Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
Accountability
3 charged and 1 publicly wanted
Return status
Not established in the public record

December 2024

Operation PowerOFF

27 booter and stresser platforms DDoS for hire

Lead
Not established
Result
27 platforms taken offline and domains seized.
Accountability
3 apprehended
Return status
Not established in the public record

May 2024

Operation Endgame

IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot Multi threat campaign

Lead
French Gendarmerie, BKA, and Dutch National Police
Result
More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.
Accountability
8 charged, 4 apprehended, and 8 publicly wanted
Return status
Not established in the public record
911 S5 botnet dismantlement

911 S5 Malware and botnets

Lead
FBI
Result
23 domains and more than 70 servers seized; botnet infrastructure dismantled; approximately 30 million USD in assets seized or restrained.
Accountability
1 charged and 1 apprehended
Return status
Not established in the public record

February 2024

Operation Cronos

LockBit Ransomware

Lead
NCA and FBI
Result
34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
Accountability
4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
Return status
Returned under the same operators

August 2023

Operation Duck Hunt

Qakbot Malware and botnets

Lead
FBI
Result
Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.
Accountability
No individual outcomes recorded
Return status
Returned under the same operators

July 2022

Hive ransomware infiltration and seizure

Hive Ransomware

Lead
FBI
Result
Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.
Accountability
No individual outcomes recorded
Return status
Returned under a new name

April 2022

Hydra Market server seizure

Hydra Market Darknet market

Lead
BKA
Result
Server infrastructure in Germany seized; approximately 543.3 BTC seized in 88 transactions; marketplace taken offline.
Accountability
1 charged and 1 publicly wanted
Return status
Followed by a successor service

January 2021

Operation Ladybird

Emotet Malware and botnets

Lead
Dutch National Police and BKA
Result
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Accountability
2 apprehended
Return status
Returned on replacement infrastructure

October 2018

Operation Trojan Shield

ANOM Criminal communications

Lead
FBI and AFP
Result
Law enforcement operated the platform itself from inception; more than 27 million messages collected from roughly 12,000 devices across more than 300 criminal syndicates; network shut down at the action week.
Accountability
9 charged
Return status
Later activity recorded, link to the original not established

April 2018

Operation PowerOFF

Webstresser.org DDoS for hire

Lead
Dutch National Police and NCA
Result
Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Accountability
6 apprehended
Return status
Followed by a successor service

March 2018

Welcome to Video seizure

Welcome to Video Child sexual abuse material

Lead
IRS-CI and HSI
Result
Server seized in South Korea and site taken offline; approximately eight terabytes of material and roughly 250,000 videos secured; Bitcoin transaction analysis used to identify users.
Accountability
1 charged, 1 apprehended, and 1 convicted
Return status
Later activity recorded, link to the original not established

June 2017

Operation Bayonet

Hansa Market Darknet market

Lead
Dutch National Police
Result
Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.
Accountability
2 apprehended
Return status
Not established in the public record

November 2016

Avalanche network takedown

Avalanche Criminal hosting and proxies

Lead
Verden Public Prosecutor
Result
More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.
Accountability
5 apprehended
Return status
Later activity recorded, link to the original not established

November 2014

Operation Onymous

Silk Road 2.0 and additional Tor marketplaces Darknet market

Lead
FBI
Result
Silk Road 2.0 hidden service seized; dozens of additional onion services seized or disabled; servers seized across multiple countries.
Accountability
1 charged and 1 apprehended
Return status
Not established in the public record

May 2014

Operation Tovar

Gameover Zeus botnet and CryptoLocker ransomware Malware and botnets

Lead
FBI and NCA
Result
Peer-to-peer and DGA command-and-control infrastructure seized and sinkholed; infected machines redirected to law-enforcement-controlled servers; CryptoLocker key server infrastructure disrupted.
Accountability
1 charged and 1 publicly wanted
Return status
Returned on replacement infrastructure

Previous Page 1 of 1 Next

Filters

Filter takedowns

Clear