Bitzlato Cryptocurrency laundering
- Lead
- USAO-EDNY and French Gendarmerie
- Result
- Digital infrastructure dismantled in France; assets seized.
- Accountability
- 1 charged, 1 apprehended, and 1 convicted
- Return status
- Not established in the public record
Public record database
Takedown Index
The Internet Takedown Index documents law enforcement seizures, sinkholes, takeovers, and shutdowns of criminal internet infrastructure. Every entry traces to a cited source.
| Takedown | Date | Category | Lead organization | Jurisdiction | Status Derived from the recorded end date. A date in the past reads Completed, no date reads Ongoing. The dataset carries no separate status column. |
|---|---|---|---|---|---|
| Bitzlato / Operation Cryptostorm ID: td_2023_bitzlato | Jan 18, 2023 | Cryptocurrency laundering | USAO-EDNY and French Gendarmerie | Not established | Completed |
| Operation PowerOFF December 2022 wave ID: td_2022_poweroff_dec | Dec 13, 2022 | DDoS for hire | FBI | International | Completed |
| iSpoof takedown ID: td_2022_ispoof | Nov 23, 2022 | Fraud and stolen data | Met Police | Not established | Completed |
| Z-Library domain seizure ID: td_2022_z_library | Nov 3, 2022 | Piracy and IP | FBI | Not established | Completed |
| Hive ransomware infiltration and seizure ID: td_2023_hive | Jul 1, 2022 | Ransomware | FBI | International | Completed |
| FluBot disruption ID: td_2022_flubot | Jun 1, 2022 | Malware and botnets | Dutch National Police | Not established | Completed |
| RSOCKS proxy botnet disruption ID: td_2022_rsocks | Jun 1, 2022 | Criminal hosting and proxies | FBI | Not established | Completed |
| Operation Tourniquet ID: td_2022_raidforums | Apr 12, 2022 | Fraud and stolen data | FBI | International | Completed |
| Cyclops Blink disruption ID: td_2022_cyclops_blink | Apr 6, 2022 | State sponsored | FBI | Not established | Completed |
| Hydra Market server seizure ID: td_2022_hydra | Apr 5, 2022 | Darknet market | BKA | International | Completed |
| VPNLab.net takedown ID: td_2022_vpnlab | Jan 18, 2022 | Criminal hosting and proxies | BKA | Not established | Completed |
| Monopoly Market seizure ID: td_2021_monopoly_market | Dec 1, 2021 | Darknet market | BKA | Not established | Completed |
| DoubleVPN takedown ID: td_2021_doublevpn | Jun 30, 2021 | Criminal hosting and proxies | Dutch National Police | Not established | Completed |
| Boystown CSAM platform takedown ID: td_2021_boystown | May 3, 2021 | Child sexual abuse material | BKA | Not established | Completed |
| Sky ECC interception and action day ID: td_2021_sky_ecc | Feb 1, 2021 | Criminal communications | Belgian Federal Police and Dutch National Police | International | Completed |
| NetWalker ransomware disruption ID: td_2021_netwalker | Jan 27, 2021 | Ransomware | FBI | International | Completed |
| Operation Ladybird ID: td_2021_emotet | Jan 26, 2021 | Malware and botnets | Dutch National Police and BKA | International | Completed |
| DarkMarket shutdown ID: td_2021_darkmarket | Jan 12, 2021 | Darknet market | BKA | Not established | Completed |
| Safe-Inet / Insorg VPN takedown ID: td_2020_safe_inet | Dec 22, 2020 | Criminal hosting and proxies | Not established | Not established | Completed |
| CityXGuide seizure ID: td_2020_cityxguide | Jun 1, 2020 | Trafficking and exploitation | FBI | Not established | Completed |
| EncroChat interception and shutdown ID: td_2020_encrochat | Apr 1, 2020 | Criminal communications | French Gendarmerie and Dutch National Police | International | Completed |
| WeLeakInfo seizure ID: td_2020_weleakinfo | Jan 15, 2020 | Fraud and stolen data | FBI | Not established | Completed |
| Islamic State web infrastructure takedown ID: td_2019_is_web_infrastructure | Nov 25, 2019 | Terrorism and extremism | Not established | Not established | Completed |
| BestMixer seizure ID: td_2019_bestmixer | May 22, 2019 | Cryptocurrency laundering | FIOD | Not established | Completed |
| DeepDotWeb domain seizure ID: td_2019_deepdotweb | May 7, 2019 | Criminal hosting and proxies | FBI | Not established | Completed |
Showing 51 to 75 of 104 takedowns
104 results
January 2023
December 2022
48 booter and stresser services DDoS for hire
- Lead
- FBI
- Result
- 48 domains seized and redirected to seizure notices.
- Accountability
- 6 charged
- Return status
- Not established in the public record
November 2022
iSpoof Fraud and stolen data
- Lead
- Met Police
- Result
- Platform infrastructure seized; service taken offline.
- Accountability
- 142 apprehended
- Return status
- Not established in the public record
Z-Library Piracy and IP
- Lead
- FBI
- Result
- Approximately 249 interrelated domains seized.
- Accountability
- 2 charged and 2 apprehended
- Return status
- Not established in the public record
July 2022
Hive Ransomware
- Lead
- FBI
- Result
- Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.
- Accountability
- No individual outcomes recorded
- Return status
- Returned under a new name
June 2022
FluBot Malware and botnets
- Lead
- Dutch National Police
- Result
- Infrastructure behind the malware was taken under control or disrupted through coordinated international measures.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
RSOCKS Criminal hosting and proxies
- Lead
- FBI
- Result
- Backend infrastructure mapped via undercover technical purchases; disruption of the proxy-selling service followed.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
April 2022
RaidForums Fraud and stolen data
- Lead
- FBI
- Result
- Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.
- Accountability
- 1 charged and 1 apprehended
- Return status
- Followed by a successor service
Cyclops Blink (attributed to Russia's GRU-linked Sandworm) State sponsored
- Lead
- FBI
- Result
- Malware copied for evidentiary purposes and then removed from compromised C2 devices under court authorization; device owners still needed to independently patch underlying vulnerabilities.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
Hydra Market Darknet market
- Lead
- BKA
- Result
- Server infrastructure in Germany seized; approximately 543.3 BTC seized in 88 transactions; marketplace taken offline.
- Accountability
- 1 charged and 1 publicly wanted
- Return status
- Followed by a successor service
January 2022
VPNLab.net Criminal hosting and proxies
- Lead
- BKA
- Result
- Servers seized in a coordinated multi-country operation.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
December 2021
Monopoly Market Darknet market
- Lead
- BKA
- Result
- Server infrastructure covertly seized and monitored before public disclosure.
- Accountability
- No individual outcomes recorded
- Return status
- Returned under the same operators
June 2021
DoubleVPN Criminal hosting and proxies
- Lead
- Dutch National Police
- Result
- Servers and domains seized.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
May 2021
Boystown and associated Tor chat services Child sexual abuse material
- Lead
- BKA
- Result
- Dark-web platform and associated chat infrastructure taken offline.
- Accountability
- 4 apprehended
- Return status
- Not established in the public record
February 2021
Sky ECC Criminal communications
- Lead
- Belgian Federal Police and Dutch National Police
- Result
- Encrypted traffic decrypted and monitored; infrastructure disrupted; large-scale searches and seizures on the action day.
- Accountability
- 48 apprehended
- Return status
- Not established in the public record
January 2021
NetWalker Ransomware
- Lead
- FBI
- Result
- Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.
- Accountability
- 1 charged
- Return status
- Not established in the public record
Emotet Malware and botnets
- Lead
- Dutch National Police and BKA
- Result
- Roughly 700 command-and-control servers taken over; infected machines redirected to law-enforcement infrastructure; a court-authorized uninstall module was delivered and triggered on 2021-04-25.
- Accountability
- 2 apprehended
- Return status
- Returned on replacement infrastructure
DarkMarket Darknet market
- Lead
- BKA
- Result
- Servers seized; site taken offline.
- Accountability
- 1 apprehended
- Return status
- Not established in the public record
December 2020
Safe-Inet (also known as Insorg) Criminal hosting and proxies
- Lead
- Not established
- Result
- VPN service infrastructure and associated domains taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
June 2020
CityXGuide Trafficking and exploitation
- Lead
- FBI
- Result
- Site infrastructure seized and taken offline.
- Accountability
- 1 charged
- Return status
- Not established in the public record
April 2020
EncroChat Criminal communications
- Lead
- French Gendarmerie and Dutch National Police
- Result
- Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.
- Accountability
- No individual outcomes recorded
- Return status
- Later activity recorded, link to the original not established
January 2020
WeLeakInfo Fraud and stolen data
- Lead
- FBI
- Result
- Domain seized and replaced with a law-enforcement notice.
- Accountability
- 2 apprehended
- Return status
- Returned on replacement infrastructure
November 2019
Islamic State web/media infrastructure Terrorism and extremism
- Lead
- Not established
- Result
- Web/media distribution infrastructure disrupted.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
May 2019
BestMixer.io Cryptocurrency laundering
- Lead
- FIOD
- Result
- Servers seized in the Netherlands, Luxembourg, and elsewhere; domain taken offline.
- Accountability
- No individual outcomes recorded
- Return status
- Not established in the public record
DeepDotWeb Criminal hosting and proxies
- Lead
- FBI
- Result
- Clearnet domain seized pursuant to US court order.
- Accountability
- 2 apprehended
- Return status
- Not established in the public record
Filters
Filter takedowns