Multiple illegal IPTV networks Piracy and IP
- Lead
- Not established
- Result
- IPTV distribution infrastructure disrupted across multiple countries.
- Accountability
- 11 apprehended
- Return status
- Not established in the public record
Public record database
Takedown Index
The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.
| Takedown | Date | Category | Lead organization | Jurisdiction | Status Derived from the recorded end date. A date in the past reads Completed, no date reads Ongoing. The dataset carries no separate status column. |
|---|---|---|---|---|---|
| European illegal IPTV enforcement action ID: td_2024_iptv_action | Nov 27, 2024 | Piracy and IP | Not established | Not established | Completed |
| INTERPOL Synergia II ID: td_2024_synergia_ii | Nov 5, 2024 | Multi threat campaign | INTERPOL | Not established | Completed |
| Operation Magnus (RedLine and META infostealers) ID: td_2024_operation_magnus | Oct 28, 2024 | Malware and botnets | Dutch National Police | Not established | Completed |
| Raptor Train botnet disruption ID: td_2024_raptor_train | Sep 1, 2024 | State sponsored | FBI | International | Completed |
| Radar/Dispossessor ransomware disruption ID: td_2024_radar_dispossessor | Aug 12, 2024 | Ransomware | FBI | Not established | Completed |
| Operation Endgame wave 1 ID: td_2024_endgame_w1 | May 27, 2024 | Multi threat campaign | French Gendarmerie, BKA, and Dutch National Police | International | Completed |
| 911 S5 botnet dismantlement ID: td_2024_911_s5 | May 24, 2024 | Malware and botnets | FBI | International | Completed |
| BreachForums domain seizure ID: td_2024_breachforums | May 15, 2024 | Fraud and stolen data | FBI | International | Completed |
| Samourai Wallet seizure ID: td_2024_samourai_wallet | Apr 24, 2024 | Cryptocurrency laundering | USAO-SDNY and IRS-CI | Not established | Completed |
| LabHost phishing-as-a-service takedown ID: td_2024_labhost | Apr 18, 2024 | Phishing | Met Police | Not established | Completed |
| Nemesis Market seizure ID: td_2024_nemesis | Mar 21, 2024 | Darknet market | BKA | Not established | Completed |
| Operation Cronos wave 1 ID: td_2024_cronos_w1 | Feb 19, 2024 | Ransomware | NCA and FBI | International | Completed |
| ALPHV/BlackCat disruption ID: td_2023_alphv_blackcat | Dec 19, 2023 | Ransomware | FBI | Not established | Completed |
| Kingdom Market seizure ID: td_2023_kingdom_market | Dec 1, 2023 | Darknet market | FBI and HSI | Not established | Completed |
| KV Botnet disruption ID: td_2024_kv_botnet | Dec 1, 2023 | State sponsored | FBI | 🇺🇸 United States | Completed |
| Sinbad cryptocurrency mixer seizure ID: td_2023_sinbad | Nov 27, 2023 | Cryptocurrency laundering | FIOD, NBI, and FBI | Not established | Completed |
| IPStorm botnet dismantlement ID: td_2023_ipstorm | Nov 1, 2023 | Malware and botnets | FBI | Not established | Completed |
| Ragnar Locker disruption ID: td_2023_ragnar_locker | Oct 20, 2023 | Ransomware | French Gendarmerie | Not established | Completed |
| Operation Duck Hunt ID: td_2023_qakbot | Aug 25, 2023 | Malware and botnets | FBI | International | Completed |
| LolekHosted seizure ID: td_2023_lolekhosted | Aug 8, 2023 | Criminal hosting and proxies | FBI | Not established | Completed |
| Operation MEDUSA ID: td_2023_snake | May 8, 2023 | State sponsored | FBI | International | Completed |
| Operation SpecTor ID: td_2023_operation_spector | May 2, 2023 | Darknet market | Not established | Not established | Completed |
| Operation Cookie Monster ID: td_2023_genesis | Apr 4, 2023 | Fraud and stolen data | FBI and Dutch National Police | International | Completed |
| BreachForums shutdown following administrator arrest ID: td_2023_breachforums | Mar 21, 2023 | Fraud and stolen data | FBI | 🇺🇸 United States | Completed |
| ChipMixer takedown ID: td_2023_chipmixer | Mar 15, 2023 | Cryptocurrency laundering | FBI and BKA | Not established | Completed |
Showing 26 to 50 of 104 takedowns
104 results
November 2024
Heterogeneous malicious infrastructure (phishing, malware, ransomware C2) Multi threat campaign
- Lead
- INTERPOL
- Result
- More than 22,000 malicious IPs, domains, servers, and related infrastructure disrupted across the campaign.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
October 2024
RedLine Stealer and META Stealer Malware and botnets
- Lead
- Dutch National Police
- Result
- Servers seized; source code and backend databases obtained.
- Accountability
- 1 charged
- Return status
- Not established in the public record
September 2024
Raptor Train State sponsored
- Lead
- FBI
- Result
- Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
August 2024
Radar (also known as Dispossessor) Ransomware
- Lead
- FBI
- Result
- Domains, servers, and IP infrastructure disabled or seized across three countries.
- Accountability
- 1 publicly wanted
- Return status
- Not established in the public record
May 2024
IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, Trickbot Multi threat campaign
- Lead
- French Gendarmerie, BKA, and Dutch National Police
- Result
- More than 100 servers disrupted or taken down; more than 2,000 domains brought under law-enforcement control; 16 location searches.
- Accountability
- 8 charged, 4 apprehended, and 8 publicly wanted
- Return status
- Not established in the public record
911 S5 Malware and botnets
- Lead
- FBI
- Result
- 23 domains and more than 70 servers seized; botnet infrastructure dismantled; approximately 30 million USD in assets seized or restrained.
- Accountability
- 1 charged and 1 apprehended
- Return status
- Not established in the public record
BreachForums (reconstituted) Fraud and stolen data
- Lead
- FBI
- Result
- Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.
- Accountability
- No individual outcomes recorded
- Return status
- Returned with some of the same operators
April 2024
Samourai Wallet Cryptocurrency laundering
- Lead
- USAO-SDNY and IRS-CI
- Result
- Web servers seized in Iceland; domain/app infrastructure seized in the US.
- Accountability
- 2 charged and 2 apprehended
- Return status
- Not established in the public record
LabHost Phishing
- Lead
- Met Police
- Result
- Platform infrastructure seized; service taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
March 2024
Nemesis Market Darknet market
- Lead
- BKA
- Result
- Server infrastructure seized; site taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
February 2024
LockBit Ransomware
- Lead
- NCA and FBI
- Result
- 34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
- Accountability
- 4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted
- Return status
- Returned under the same operators
December 2023
ALPHV/BlackCat Ransomware
- Lead
- FBI
- Result
- Leak-site and negotiation infrastructure disrupted; decryption keys/tooling provided to victims.
- Accountability
- No individual outcomes recorded
- Return status
- Returned under the same operators
Kingdom Market Darknet market
- Lead
- FBI and HSI
- Result
- Online infrastructure shut down.
- Accountability
- 1 charged and 1 apprehended
- Return status
- Not established in the public record
KV Botnet State sponsored
- Lead
- FBI
- Result
- Malware deleted from compromised routers; command-and-control connections severed; steps taken to prevent reinfection without affecting legitimate router functions.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
November 2023
Sinbad Cryptocurrency laundering
- Lead
- FIOD, NBI, and FBI
- Result
- Mixer infrastructure and domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
IPStorm Malware and botnets
- Lead
- FBI
- Result
- Botnet infrastructure dismantled in connection with the criminal prosecution.
- Accountability
- 1 convicted
- Return status
- Not established in the public record
October 2023
Ragnar Locker Ransomware
- Lead
- French Gendarmerie
- Result
- Ransomware infrastructure seized across multiple European jurisdictions; leak site taken down.
- Accountability
- 1 apprehended
- Return status
- Not established in the public record
August 2023
Qakbot Malware and botnets
- Lead
- FBI
- Result
- Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.
- Accountability
- No individual outcomes recorded
- Return status
- Returned under the same operators
LolekHosted.net Criminal hosting and proxies
- Lead
- FBI
- Result
- Domain and associated hosting infrastructure seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
May 2023
Snake malware network State sponsored
- Lead
- FBI
- Result
- Snake implants on victim machines disabled by issuing commands that caused the malware to overwrite its own vital components; peer-to-peer network neutralized.
- Accountability
- No individual outcomes recorded
- Return status
- Later activity recorded, link to the original not established
Multiple darknet-market vendors and buyers (Monopoly Market intelligence) Darknet market
- Lead
- Not established
- Result
- No new infrastructure seizure; operation used previously seized Monopoly Market data/evidence to support arrests.
- Accountability
- 288 apprehended
- Return status
- Not established in the public record
April 2023
Genesis Market Fraud and stolen data
- Lead
- FBI and Dutch National Police
- Result
- Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.
- Accountability
- 119 apprehended
- Return status
- Not established in the public record
March 2023
BreachForums Fraud and stolen data
- Lead
- FBI
- Result
- Forum taken offline by a remaining staff member citing law-enforcement access to infrastructure; administrator's devices and accounts seized.
- Accountability
- 1 charged, 1 apprehended, and 1 convicted
- Return status
- Returned with some of the same operators
ChipMixer Cryptocurrency laundering
- Lead
- FBI and BKA
- Result
- Server infrastructure seized in Germany; associated domains seized by US authorities.
- Accountability
- 1 charged and 1 publicly wanted
- Return status
- Not established in the public record
Filters
Filter takedowns