Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions
Last reviewed August 20, 2026
Reset filters
Jurisdiction: European Union Clear all filters
Takedown Date Category Lead organization Jurisdiction Status
Operation PowerOFF April 2026 wave ID: td_2026_poweroff_apr Apr 13, 2026 DDoS for hire Not established International Completed
Operation Endgame wave 3 ID: td_2025_endgame_w3 Nov 10, 2025 Multi threat campaign Not established International Completed
Operation Deep Sentinel ID: td_2025_archetyp Jun 11, 2025 Darknet market BKA International Completed
Lumma Stealer disruption ID: td_2025_lumma May 13, 2025 Malware and botnets Microsoft DCU and DOJ International Completed
Operation PowerOFF December 2024 wave ID: td_2024_poweroff_dec Dec 1, 2024 DDoS for hire Not established International Completed
BreachForums domain seizure ID: td_2024_breachforums May 15, 2024 Fraud and stolen data FBI International Completed
Operation Cookie Monster ID: td_2023_genesis Apr 4, 2023 Fraud and stolen data FBI and Dutch National Police International Completed
Hive ransomware infiltration and seizure ID: td_2023_hive Jul 1, 2022 Ransomware FBI International Completed
Operation Tourniquet ID: td_2022_raidforums Apr 12, 2022 Fraud and stolen data FBI International Completed
Sky ECC interception and action day ID: td_2021_sky_ecc Feb 1, 2021 Criminal communications Belgian Federal Police and Dutch National Police International Completed
Operation Ladybird ID: td_2021_emotet Jan 26, 2021 Malware and botnets Dutch National Police and BKA International Completed
EncroChat interception and shutdown ID: td_2020_encrochat Apr 1, 2020 Criminal communications French Gendarmerie and Dutch National Police International Completed
Operation Trojan Shield ID: td_2021_anom Oct 1, 2018 Criminal communications FBI and AFP International Completed
Webstresser.org takedown ID: td_2018_webstresser Apr 24, 2018 DDoS for hire Dutch National Police and NCA International Completed
Hansa covert takeover and shutdown ID: td_2017_hansa Jun 20, 2017 Darknet market Dutch National Police International Completed
Avalanche network takedown ID: td_2016_avalanche Nov 30, 2016 Criminal hosting and proxies Verden Public Prosecutor International Completed
Operation Onymous ID: td_2014_operation_onymous Nov 5, 2014 Darknet market FBI International Completed
Operation Tovar ID: td_2014_gameover_zeus May 30, 2014 Malware and botnets FBI and NCA International Completed

Showing 1 to 18 of 18 takedowns

18 results

April 2026

Operation PowerOFF

53 booter and stresser domains DDoS for hire

Lead
Not established
Result
53 domains seized; more than three million criminal accounts exposed; more than 75,000 warning messages sent to users.
Accountability
4 apprehended
Return status
Not established in the public record

November 2025

Operation Endgame

Rhadamanthys, VenomRAT, Elysium botnet Multi threat campaign

Lead
Not established
Result
More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
Accountability
1 apprehended
Return status
Not established in the public record

June 2025

Operation Deep Sentinel

Archetyp Market Darknet market

Lead
BKA
Result
Server infrastructure seized by Dutch police; marketplace taken offline and replaced with seizure notice; approximately 7.8 million EUR in assets seized.
Accountability
8 apprehended
Return status
Later activity recorded, link to the original not established

May 2025

Lumma Stealer disruption

Lumma Stealer Malware and botnets

Lead
Microsoft DCU and DOJ
Result
Approximately 2,300 malicious domains seized or redirected to Microsoft sinkholes; DOJ seized the central command structure and marketplaces selling the malware; European and Japanese infrastructure suspended.
Accountability
No individual outcomes recorded
Return status
Returned under the same operators

December 2024

Operation PowerOFF

27 booter and stresser platforms DDoS for hire

Lead
Not established
Result
27 platforms taken offline and domains seized.
Accountability
3 apprehended
Return status
Not established in the public record

May 2024

BreachForums domain seizure

BreachForums (reconstituted) Fraud and stolen data

Lead
FBI
Result
Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.
Accountability
No individual outcomes recorded
Return status
Returned with some of the same operators

April 2023

Operation Cookie Monster

Genesis Market Fraud and stolen data

Lead
FBI and Dutch National Police
Result
Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.
Accountability
119 apprehended
Return status
Not established in the public record

July 2022

Hive ransomware infiltration and seizure

Hive Ransomware

Lead
FBI
Result
Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.
Accountability
No individual outcomes recorded
Return status
Returned under a new name

April 2022

Operation Tourniquet

RaidForums Fraud and stolen data

Lead
FBI
Result
Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.
Accountability
1 charged and 1 apprehended
Return status
Followed by a successor service

February 2021

Sky ECC interception and action day

Sky ECC Criminal communications

Lead
Belgian Federal Police and Dutch National Police
Result
Encrypted traffic decrypted and monitored; infrastructure disrupted; large-scale searches and seizures on the action day.
Accountability
48 apprehended
Return status
Not established in the public record

January 2021

Operation Ladybird

Emotet Malware and botnets

Lead
Dutch National Police and BKA
Result
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Accountability
2 apprehended
Return status
Returned on replacement infrastructure

April 2020

EncroChat interception and shutdown

EncroChat Criminal communications

Lead
French Gendarmerie and Dutch National Police
Result
Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.
Accountability
No individual outcomes recorded
Return status
Later activity recorded, link to the original not established

October 2018

Operation Trojan Shield

ANOM Criminal communications

Lead
FBI and AFP
Result
Law enforcement operated the platform itself from inception; more than 27 million messages collected from roughly 12,000 devices across more than 300 criminal syndicates; network shut down at the action week.
Accountability
9 charged
Return status
Later activity recorded, link to the original not established

April 2018

Operation PowerOFF

Webstresser.org DDoS for hire

Lead
Dutch National Police and NCA
Result
Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Accountability
6 apprehended
Return status
Followed by a successor service

June 2017

Operation Bayonet

Hansa Market Darknet market

Lead
Dutch National Police
Result
Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.
Accountability
2 apprehended
Return status
Not established in the public record

November 2016

Avalanche network takedown

Avalanche Criminal hosting and proxies

Lead
Verden Public Prosecutor
Result
More than 800,000 domains seized, sinkholed, or blocked; 39 servers seized; 37 premises searched.
Accountability
5 apprehended
Return status
Later activity recorded, link to the original not established

November 2014

Operation Onymous

Silk Road 2.0 and additional Tor marketplaces Darknet market

Lead
FBI
Result
Silk Road 2.0 hidden service seized; dozens of additional onion services seized or disabled; servers seized across multiple countries.
Accountability
1 charged and 1 apprehended
Return status
Not established in the public record

May 2014

Operation Tovar

Gameover Zeus botnet and CryptoLocker ransomware Malware and botnets

Lead
FBI and NCA
Result
Peer-to-peer and DGA command-and-control infrastructure seized and sinkholed; infected machines redirected to law-enforcement-controlled servers; CryptoLocker key server infrastructure disrupted.
Accountability
1 charged and 1 publicly wanted
Return status
Returned on replacement infrastructure

Previous Page 1 of 1 Next

Filters

Filter takedowns

Clear