US and Canadian authorities have seized internet domains linked to the NightmareStresser distributed denial-of-service (DDoS) for-hire platform, disrupting what prosecutors describe as one of the world’s longest-running “booter” services[6][9][14]. The takedown removes a criminal marketplace that allowed paying customers to launch powerful DDoS attacks against targets in the U.S. and around the world[6][14].
In a statement from the U.S. Attorney’s Office for the District of Alaska, the Department of Justice said it had obtained court authorization to seize the domains associated with NightmareStresser[6]. Since 2022, the service was used to conduct “hundreds of thousands of actual or attempted DDoS attacks” against victims worldwide, making it a major player in the DDoS-for-hire ecosystem[6][11][14]. Authorities characterized NightmareStresser as one of the world’s longest-running DDoS-for-hire operations, despite only being publicly tracked in recent years[1][6][9].
The seized domains, including nightmare-stresser.com and nightmarestresser.org, now display a law-enforcement splash page explaining that the sites have been taken offline as part of an ongoing criminal investigation[1][6][14]. The operation, led by the FBI’s Anchorage Field Office with support from the Royal Canadian Mounted Police, forms part of Operation PowerOFF, a coordinated international effort targeting so-called “booter” and “stresser” services that sell on-demand DDoS capacity[6][7][9].
Authorities said the NightmareStresser infrastructure enabled customers to overwhelm targeted networks and services with junk traffic, knocking legitimate users offline or significantly degrading performance[6][14]. Victims included organizations in the District of Alaska and elsewhere in the United States, as well as entities overseas, though officials have not publicly named specific companies or agencies impacted by the attacks[6][9]. Law enforcement officials framed the takedown as both a direct disruption of criminal activity and a warning to those who operate or use DDoS-for-hire platforms[6][11].
Operation PowerOFF has been ongoing for several years and has already resulted in the seizure of more than 100 domains and charges against at least a dozen individuals linked to similar services, according to prior announcements referenced in coverage of the NightmareStresser action[9][12][14]. By continually removing these platforms and pursuing their operators, investigators aim to raise the risks and costs associated with commissioning DDoS attacks, even as new services attempt to replace those taken down[4][9].
For defenders, the disruption of a prolific booter service offers some relief but does not eliminate the DDoS threat landscape. Security teams are urged to maintain relationships with upstream providers and DDoS mitigation services, ensure incident response plans include playbooks for volumetric attacks, and monitor for unusual traffic patterns that could signal an attack in progress[5][8][14]. Organizations that have previously relied on traffic scrubbing centers, content delivery networks, or on-premises protections should also review their configurations and logging to verify they can withstand attacks even as law enforcement pressure forces adversaries to adjust their tooling and infrastructure[5][8].
References
- NightmareStresser DDoS Service Disrupted in International Operation
- NightmareStresser Goes Offline in Global DDoS-for-Hire …
- FBI Takes Down NightmareStresser DDoS Service Used in Hundreds of Thousands of Attacks
- District of Alaska | FBI Seizes DDoS-for-Hire Domains as Part of …
- NightmareStresser domains seized in FBI DDoS-for-hire crackdown
- U.S. Seizes NightmareStresser Domains Linked to …
- Authorities seize popular, long-running DDoS-for-hire …
- FBI Cyber Division on X
- NightmareStresser group responsible for thousands of DDOS …
- US takes down NightmareStresser DDoS-for-hire platform
