DOJ AND FBI SEIZE NIGHTMARESTRESSER DOMAINS IN INTERNATIONAL CRACKDOWN ON DDoS-FOR-HIRE SERVICES

ANCHORAGE, Alaska — The Justice Department and FBI have seized internet domains associated with NightmareStresser, a long-running distributed denial-of-service-for-hire platform accused of enabling hundreds of thousands of actual or attempted cyberattacks against victims around the world.

The court-authorized seizure was carried out by the FBI Anchorage Field Office in coordination with the Royal Canadian Mounted Police Federal Policing Northwest Region as part of the international Operation PowerOFF campaign targeting illegal booter and stresser services.

NightmareStresser operated as a commercial DDoS-for-hire service, allowing paying customers to direct overwhelming volumes of malicious internet traffic at websites, servers, networks, and online services.

According to the Justice Department, the platform had been used since 2022 to launch hundreds of thousands of actual or attempted DDoS attacks against victims worldwide. Targets included educational institutions, government agencies, gaming platforms, and other organizations serving millions of users.

A distributed denial-of-service attack works by directing massive amounts of traffic or connection requests toward a target until its infrastructure can no longer respond normally.

The result can range from severe performance degradation to a complete loss of internet connectivity.

For businesses, schools, public agencies, gaming services, and infrastructure providers, even a relatively short disruption can prevent legitimate users from accessing websites, applications, communications systems, or other network-dependent services.

The Justice Department says booter and stresser platforms lower the barrier to conducting those attacks by turning DDoS capability into a commercial service.

Instead of building a botnet or developing attack infrastructure themselves, customers can purchase access to a platform and select a target.

The terms “booter” and “stresser” are sometimes used by operators to portray these services as legitimate network-testing tools. Federal authorities have repeatedly warned that directing attacks against systems without authorization is illegal.

NightmareStresser had publicly promoted itself as a powerful and established DDoS platform, presenting its services as capable of delivering large-scale attacks.

Federal investigators took a different view.

According to the seizure warrant affidavit, NightmareStresser was used to launch hundreds of thousands of actual or attempted DDoS attacks against victims worldwide since 2022.

NightmareStresser was not new to federal law enforcement.

The Justice Department has carried out repeated enforcement actions against DDoS-for-hire services over the last eight years, including domain seizures and prosecutions in Alaska and California.

The latest action targets the platform again as federal authorities continue efforts to dismantle DDoS-for-hire services rather than treating a single domain seizure as the end of an investigation.

That approach has become central to Operation PowerOFF, an international law-enforcement campaign operating since 2017 against criminal DDoS services.

Europol describes PowerOFF as a continuing global effort coordinated with law-enforcement agencies across numerous countries to dismantle the servers, domains, databases, payment infrastructure, and administrative systems that support DDoS-for-hire operations.

The operation targets both service operators and users.

In April 2026, authorities from 21 countries participated in another coordinated PowerOFF action targeting DDoS-for-hire infrastructure and users.

That operation resulted in 53 domains being taken down, four arrests, 25 search warrants, and more than 75,000 warning letters and emails being sent to identified users of DDoS-for-hire services.

Authorities also removed more than 100 URLs advertising DDoS services from search results and sent warning messages through blockchain networks associated with payments made for the services.

Those actions show how law enforcement has expanded its strategy beyond server seizures.

Investigators are also focusing on customer databases, payment trails, advertising channels, administrators, infrastructure providers, and users who purchase attacks.

The Justice Department says prosecutors and investigators in Alaska and California have, during the last eight years, charged 12 defendants accused of facilitating DDoS-for-hire services and seized more than 100 internet domains connected to those platforms.

The federal strategy seeks to repeatedly disrupt the marketplace itself.

DDoS-for-hire services can reappear after a domain is seized, move to another hosting provider, switch payment systems, rebuild under another name, or transfer their customer base to another platform.

That makes enforcement an ongoing process rather than a single takedown.

The government’s focus on NightmareStresser also reflects the scale that commercial DDoS platforms can reach.

A service capable of automating attacks for thousands of customers can transform what once required substantial technical knowledge into an activity available through a web interface and a payment.

Europol says some DDoS-for-hire services have offered attacks for as little as €10, making disruptive cyber capability accessible even to users with limited technical knowledge.

Motives can vary widely.

DDoS attacks have been used in online feuds, gaming disputes, extortion attempts, ideological campaigns, attacks against businesses, and operations directed at public institutions.

They can also serve as part of broader criminal activity by distracting defenders while attackers conduct other operations against a network.

Federal authorities emphasized that the damage extends beyond the immediate target.

Large DDoS attacks can consume upstream bandwidth and infrastructure resources, affecting service providers and users who were never the original target.

The Justice Department said attacks facilitated through services such as NightmareStresser can significantly degrade internet service and, in some cases, completely interrupt connections.

The latest enforcement action did not announce arrests connected specifically to the NightmareStresser seizure.

DOJ identified the action as an infrastructure disruption carried out under court authority and did not disclose whether additional individuals are currently being investigated.

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney for the District of Alaska are prosecuting the matter.

The involvement of the District of Alaska is also significant.

Federal authorities said the platform facilitated attacks affecting victims within Alaska as well as elsewhere in the United States and internationally, providing a jurisdictional basis for the federal investigation and seizure action.

The Royal Canadian Mounted Police participated in the operation, reflecting the cross-border nature of the infrastructure and investigations surrounding modern DDoS services.

The seizure of NightmareStresser is another step in a law-enforcement campaign that has continued for nearly a decade.

Rather than focusing only on individual attackers, agencies are targeting the commercial infrastructure that makes large-scale attacks available on demand.

The strategy is designed to remove domains, dismantle technical systems, identify administrators, trace payments, warn users, and reduce the availability of platforms that turn cyberattacks into purchasable services.

NightmareStresser may have marketed itself as a network stress-testing platform.

Federal investigators allege it became something substantially different: infrastructure used to launch hundreds of thousands of attacks against organizations and internet users around the world.

The domains have been seized, and the wider international effort against the DDoS-for-hire industry continues.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---