Skip to main content

Public record database

Takedown Index

The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.

104 takedowns indexed Across 37 jurisdictions
Last reviewed August 20, 2026
Reset filters
Jurisdiction: Netherlands Clear all filters
Takedown Date Category Lead organization Jurisdiction Status
Operation Endgame wave 3 ID: td_2025_endgame_w3 Nov 10, 2025 Multi threat campaign Not established International Completed
Operation Deep Sentinel ID: td_2025_archetyp Jun 11, 2025 Darknet market BKA International Completed
Operation Endgame wave 2 ID: td_2025_endgame_w2 May 19, 2025 Multi threat campaign BKA International Completed
Operation PowerOFF December 2024 wave ID: td_2024_poweroff_dec Dec 1, 2024 DDoS for hire Not established International Completed
Operation Endgame wave 1 ID: td_2024_endgame_w1 May 27, 2024 Multi threat campaign French Gendarmerie, BKA, and Dutch National Police International Completed
Operation Cronos wave 1 ID: td_2024_cronos_w1 Feb 19, 2024 Ransomware NCA and FBI International Completed
Operation Duck Hunt ID: td_2023_qakbot Aug 25, 2023 Malware and botnets FBI International Completed
Operation Cookie Monster ID: td_2023_genesis Apr 4, 2023 Fraud and stolen data FBI and Dutch National Police International Completed
Operation PowerOFF December 2022 wave ID: td_2022_poweroff_dec Dec 13, 2022 DDoS for hire FBI International Completed
Hive ransomware infiltration and seizure ID: td_2023_hive Jul 1, 2022 Ransomware FBI International Completed
Sky ECC interception and action day ID: td_2021_sky_ecc Feb 1, 2021 Criminal communications Belgian Federal Police and Dutch National Police International Completed
Operation Ladybird ID: td_2021_emotet Jan 26, 2021 Malware and botnets Dutch National Police and BKA International Completed
EncroChat interception and shutdown ID: td_2020_encrochat Apr 1, 2020 Criminal communications French Gendarmerie and Dutch National Police International Completed
Operation Trojan Shield ID: td_2021_anom Oct 1, 2018 Criminal communications FBI and AFP International Completed
Webstresser.org takedown ID: td_2018_webstresser Apr 24, 2018 DDoS for hire Dutch National Police and NCA International Completed
AlphaBay seizure ID: td_2017_alphabay Jul 4, 2017 Darknet market FBI and DEA International Completed
Hansa covert takeover and shutdown ID: td_2017_hansa Jun 20, 2017 Darknet market Dutch National Police International Completed
Operation Onymous ID: td_2014_operation_onymous Nov 5, 2014 Darknet market FBI International Completed
Operation Tovar ID: td_2014_gameover_zeus May 30, 2014 Malware and botnets FBI and NCA International Completed

Showing 1 to 19 of 19 takedowns

19 results

November 2025

Operation Endgame

Rhadamanthys, VenomRAT, Elysium botnet Multi threat campaign

Lead
Not established
Result
More than 1,000 servers disrupted; approximately 20 domains seized; access to several hundred thousand infected machines removed from operators.
Accountability
1 apprehended
Return status
Not established in the public record

June 2025

Operation Deep Sentinel

Archetyp Market Darknet market

Lead
BKA
Result
Server infrastructure seized by Dutch police; marketplace taken offline and replaced with seizure notice; approximately 7.8 million EUR in assets seized.
Accountability
8 apprehended
Return status
Later activity recorded, link to the original not established

May 2025

Operation Endgame

DanaBot, Bumblebee, Lactrodectus, Qakbot, HijackLoader, Trickbot, Warmcookie Multi threat campaign

Lead
BKA
Result
Approximately 300 servers disrupted worldwide; roughly 650 domains neutralized; approximately 3.5 million EUR in cryptocurrency seized during the wave.
Accountability
3 charged and 1 publicly wanted
Return status
Not established in the public record

December 2024

Operation PowerOFF

27 booter and stresser platforms DDoS for hire

Lead
Not established
Result
27 platforms taken offline and domains seized.
Accountability
3 apprehended
Return status
Not established in the public record

May 2024

Operation Endgame

IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot Multi threat campaign

Lead
French Gendarmerie, BKA, and Dutch National Police
Result
More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.
Accountability
8 charged, 4 apprehended, and 8 publicly wanted
Return status
Not established in the public record

February 2024

Operation Cronos

LockBit Ransomware

Lead
NCA and FBI
Result
34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
Accountability
4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
Return status
Returned under the same operators

August 2023

Operation Duck Hunt

Qakbot Malware and botnets

Lead
FBI
Result
Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.
Accountability
No individual outcomes recorded
Return status
Returned under the same operators

April 2023

Operation Cookie Monster

Genesis Market Fraud and stolen data

Lead
FBI and Dutch National Police
Result
Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.
Accountability
119 apprehended
Return status
Not established in the public record

December 2022

Operation PowerOFF

48 booter and stresser services DDoS for hire

Lead
FBI
Result
48 domains seized and redirected to seizure notices.
Accountability
6 charged
Return status
Not established in the public record

July 2022

Hive ransomware infiltration and seizure

Hive Ransomware

Lead
FBI
Result
Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.
Accountability
No individual outcomes recorded
Return status
Returned under a new name

February 2021

Sky ECC interception and action day

Sky ECC Criminal communications

Lead
Belgian Federal Police and Dutch National Police
Result
Encrypted traffic decrypted and monitored; infrastructure disrupted; large-scale searches and seizures on the action day.
Accountability
48 apprehended
Return status
Not established in the public record

January 2021

Operation Ladybird

Emotet Malware and botnets

Lead
Dutch National Police and BKA
Result
Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
Accountability
2 apprehended
Return status
Returned on replacement infrastructure

April 2020

EncroChat interception and shutdown

EncroChat Criminal communications

Lead
French Gendarmerie and Dutch National Police
Result
Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.
Accountability
No individual outcomes recorded
Return status
Later activity recorded, link to the original not established

October 2018

Operation Trojan Shield

ANOM Criminal communications

Lead
FBI and AFP
Result
Law enforcement operated the platform itself from inception; more than 27 million messages collected from roughly 12,000 devices across more than 300 criminal syndicates; network shut down at the action week.
Accountability
9 charged
Return status
Later activity recorded, link to the original not established

April 2018

Operation PowerOFF

Webstresser.org DDoS for hire

Lead
Dutch National Police and NCA
Result
Service infrastructure seized in the Netherlands, the United States, and Germany; domain taken offline and replaced with a seizure notice.
Accountability
6 apprehended
Return status
Followed by a successor service

July 2017

Operation Bayonet

AlphaBay Darknet market

Lead
FBI and DEA
Result
Marketplace servers and hidden service seized; site taken offline; assets and cryptocurrency frozen in multiple jurisdictions.
Accountability
1 charged and 1 apprehended
Return status
Followed by a successor service

June 2017

Operation Bayonet

Hansa Market Darknet market

Lead
Dutch National Police
Result
Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.
Accountability
2 apprehended
Return status
Not established in the public record

November 2014

Operation Onymous

Silk Road 2.0 and additional Tor marketplaces Darknet market

Lead
FBI
Result
Silk Road 2.0 hidden service seized; dozens of additional onion services seized or disabled; servers seized across multiple countries.
Accountability
1 charged and 1 apprehended
Return status
Not established in the public record

May 2014

Operation Tovar

Gameover Zeus botnet and CryptoLocker ransomware Malware and botnets

Lead
FBI and NCA
Result
Peer-to-peer and DGA command-and-control infrastructure seized and sinkholed; infected machines redirected to law-enforcement-controlled servers; CryptoLocker key server infrastructure disrupted.
Accountability
1 charged and 1 publicly wanted
Return status
Returned on replacement infrastructure

Previous Page 1 of 1 Next

Filters

Filter takedowns

Clear