Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

105 takedowns indexed Across 99 jurisdictions
Last reviewed August 23, 2026
Reset filters
Jurisdiction: Italy Clear all filters
Takedown Date Category Lead organization Jurisdiction Status
CFAKE.com and SOCFAKE.com seizure Jun 11, 2026 Other HSI International Completed
Operation Stream / Kidflix Mar 10, 2025 Child sexual abuse material BLKA International Completed
Matrix encrypted messaging service takedown Dec 3, 2024 Criminal communications Dutch National Police International Completed
Ragnar Locker disruption Oct 16, 2023 Ransomware French Gendarmerie International Completed
Operation Babylon Jul 29, 2015 Child sexual abuse material Polizia Postale 🇮🇹 Italy Completed
Ramnit botnet disruption Feb 24, 2015 Malware and botnets NCA International Completed
Operation Tovar May 30, 2014 Malware and botnets FBI International Completed
DoubleVPN takedown Date not established Criminal hosting and proxies Dutch National Police International Completed

Showing 1 to 8 of 8 takedowns

8 results

June 2026

CFAKE.com and SOCFAKE.com seizure

CFAKE.com and SOCFAKE.com Other

Lead
HSI
Result
Both domains seized, halting publication of the forged imagery; French authorities additionally seized cryptocurrency in connection with the parallel investigation.
Accountability
1 apprehended
Return status
Not established in the public record

March 2025

Operation Stream / Kidflix

Kidflix Child sexual abuse material

Lead
BLKA
Result
Server seized March 11, 2025; 79 arrests, 1,393 suspects identified, more than 3,000 devices seized, and 39 children protected as of announcement.
Accountability
79 apprehended
Return status
Not established in the public record

December 2024

Matrix encrypted messaging service takedown

Matrix Criminal communications

Lead
Dutch National Police
Result
Infrastructure of more than 40 servers across several countries; the main servers in France and Germany were taken down on 3 December 2024. Authorities had intercepted the service for three months beforehand, capturing and deciphering more than 2.3 million messages in 33 languages, and replaced the service with a splash page.
Accountability
3 apprehended
Return status
Not established in the public record

October 2023

Ragnar Locker disruption

Ragnar Locker Ransomware

Lead
French Gendarmerie
Result
Ransomware infrastructure seized across multiple European jurisdictions; leak site taken down.
Accountability
1 apprehended
Return status
Later activity recorded, link to the original not established

July 2015

Operation Babylon

Unnamed Tor CSAM/illicit-market hidden service Child sexual abuse material

Lead
Polizia Postale
Result
Tor hidden service shut down; approximately 14,000 associated bitcoin wallets seized in connection with the administrator's residence search.
Accountability
No individual outcomes recorded
Return status
Later activity recorded, link to the original not established

February 2015

Ramnit botnet disruption

Ramnit Malware and botnets

Lead
NCA
Result
Command and control servers were shut down and 300 internet domain addresses used by the botnet's operators were redirected.
Accountability
No individual outcomes recorded
Return status
Returned on replacement infrastructure

May 2014

Operation Tovar

Gameover Zeus botnet and CryptoLocker ransomware Malware and botnets

Lead
FBI
Result
Peer-to-peer and DGA command-and-control infrastructure seized and sinkholed; infected machines redirected to law-enforcement-controlled servers; CryptoLocker key server infrastructure disrupted.
Accountability
1 charged and 1 publicly wanted
Return status
Returned on replacement infrastructure

Date not established

Previous Page 1 of 1 Next

Filters

Filter takedowns

Clear