Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions
Last reviewed August 20, 2026
Takedown Date Category Lead organization Jurisdiction Status Derived from the recorded end date. A date in the past reads Completed, no date reads Ongoing. The dataset carries no separate status column.
Operation Endgame wave 3 ID: td_2025_endgame_w3 Nov 10, 2025 Multi threat campaign Not established International Completed
Operation Endgame wave 2 ID: td_2025_endgame_w2 May 19, 2025 Multi threat campaign BKA International Completed
BreachForums portal seizure (2025) ID: td_2025_breachforums Jan 1, 2025 Fraud and stolen data Not established International Ongoing
Operation PowerOFF December 2024 wave ID: td_2024_poweroff_dec Dec 1, 2024 DDoS for hire Not established International Completed
Raptor Train botnet disruption ID: td_2024_raptor_train Sep 1, 2024 State sponsored FBI International Completed
Operation Endgame wave 1 ID: td_2024_endgame_w1 May 27, 2024 Multi threat campaign French Gendarmerie, BKA, and Dutch National Police International Completed
Operation Cronos wave 1 ID: td_2024_cronos_w1 Feb 19, 2024 Ransomware NCA and FBI International Completed
Operation Duck Hunt ID: td_2023_qakbot Aug 25, 2023 Malware and botnets FBI International Completed
Sky ECC interception and action day ID: td_2021_sky_ecc Feb 1, 2021 Criminal communications Belgian Federal Police and Dutch National Police International Completed
Operation Ladybird ID: td_2021_emotet Jan 26, 2021 Malware and botnets Dutch National Police and BKA International Completed
EncroChat interception and shutdown ID: td_2020_encrochat Apr 1, 2020 Criminal communications French Gendarmerie and Dutch National Police International Completed
Operation Onymous ID: td_2014_operation_onymous Nov 5, 2014 Darknet market FBI International Completed

Showing 1 to 12 of 12 takedowns

12 results

November 2025

Operation Endgame

Rhadamanthys, VenomRAT, Elysium botnet Multi threat campaign

Lead
Not established
Result
More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
Accountability
1 apprehended
Return status
Not established in the public record

May 2025

Operation Endgame

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie Multi threat campaign

Lead
BKA
Result
Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
Accountability
3 charged and 1 publicly wanted
Return status
Not established in the public record

January 2025

BreachForums portal seizure (2025)

BreachForums (further reconstituted) Fraud and stolen data

Lead
Not established
Result
Portal infrastructure seized and replaced with a law-enforcement notice.
Accountability
No individual outcomes recorded
Return status
Not established in the public record

December 2024

Operation PowerOFF

27 booter and stresser platforms DDoS for hire

Lead
Not established
Result
27 platforms taken offline and domains seized.
Accountability
3 apprehended
Return status
Not established in the public record

September 2024

Raptor Train botnet disruption

Raptor Train State sponsored

Lead
FBI
Result
Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.
Accountability
No individual outcomes recorded
Return status
Not established in the public record

May 2024

Operation Endgame

IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot Multi threat campaign

Lead
French Gendarmerie, BKA, and Dutch National Police
Result
More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.
Accountability
8 charged, 4 apprehended, and 8 publicly wanted
Return status
Not established in the public record

February 2024

Operation Cronos

LockBit Ransomware

Lead
NCA and FBI
Result
34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
Accountability
4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
Return status
Returned under the same operators

August 2023

Operation Duck Hunt

Qakbot Malware and botnets

Lead
FBI
Result
Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.
Accountability
No individual outcomes recorded
Return status
Returned under the same operators

February 2021

Sky ECC interception and action day

Sky ECC Criminal communications

Lead
Belgian Federal Police and Dutch National Police
Result
Encrypted traffic decrypted and monitored; infrastructure disrupted; large-scale searches and seizures on the action day.
Accountability
48 apprehended
Return status
Not established in the public record

January 2021

Operation Ladybird

Emotet Malware and botnets

Lead
Dutch National Police and BKA
Result
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Accountability
2 apprehended
Return status
Returned on replacement infrastructure

April 2020

EncroChat interception and shutdown

EncroChat Criminal communications

Lead
French Gendarmerie and Dutch National Police
Result
Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.
Accountability
No individual outcomes recorded
Return status
Later activity recorded, link to the original not established

November 2014

Operation Onymous

Silk Road 2.0 and additional Tor marketplaces Darknet market

Lead
FBI
Result
Silk Road 2.0 hidden service seized; dozens of additional onion services seized or disabled; servers seized across multiple countries.
Accountability
1 charged and 1 apprehended
Return status
Not established in the public record

Previous Page 1 of 1 Next

Filters

Filter takedowns