Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions

Last reviewed August 20, 2026

Search takedowns

Category

Year

Jurisdiction

Lead organization

Sort by

Reset filters

Jurisdiction: Finland Clear all filters

Takedown	Date	Category	Lead organization	Jurisdiction	Status Derived from the recorded end date. A date in the past reads Completed, no date reads Ongoing. The dataset carries no separate status column.
Operation Cronos wave 1 ID: td_2024_cronos_w1	Feb 19, 2024	Ransomware	NCA and FBI	International	Completed
Operation Trojan Shield ID: td_2021_anom	Oct 1, 2018	Criminal communications	FBI and AFP	International	Completed

Showing 1 to 2 of 2 takedowns

Rows per page

2 results

February 2024

Operation Cronos

LockBit Ransomware

Lead: NCA and FBI
Result: 34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
Accountability: 4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
Return status: Returned under the same operators

October 2018

Operation Trojan Shield

ANOM Criminal communications

Lead: FBI and AFP
Result: Law enforcement operated the platform itself from inception; more than 27 million messages collected from roughly 12,000 devices across more than 300 criminal syndicates; network shut down at the action week.
Accountability: 9 charged
Return status: Later activity recorded, link to the original not established

Previous Page 1 of 1 Next

Takedown Index

Filters

Category Any

Year Any

Jurisdiction Finland

Lead organization Any

Charged Any

Apprehended Any