The FBI has carried out a NightmareStresser DDoS takedown, seizing the domains used by one of the world’s longest-running DDoS-for-hire platforms. The action, announced on Wednesday, adds another chapter to Operation PowerOFF, the long-running international law enforcement effort targeting so-called booter services worldwide.
The seized domains, nightmare-stresser[.]com and nightmarestresser[.]org, now display a seizure banner stating that the action was supported by Operation PowerOFF. Before they were taken offline, the platform described itself as the ‘#1 online IP booter’ and ‘the only DDoS tool available 24/7.’ Those are bold claims for a service now bearing the FBI’s watermark.
What NightmareStresser was and how it operated
Booter services like NightmareStresser let anyone with a credit card rent access to large botnets built from compromised routers and internet-of-things (IoT) devices, then aim them at virtually any target they choose. As cybersecurity firm Searchlight Cyber reported in 2023, NightmareStresser had accumulated over 566,000 registered users and ran on 52 dedicated servers capable of launching attacks of up to 200 Gbps. Those attacks could target multiple layers of a network simultaneously, including Layer 7 application protocols and Layer 4 TCP/UDP protocols, the kind of multi-vector assault that can bring down infrastructure far more resilient than a typical website.
The FBI Cyber Division said on Wednesday that since 2022, the NightmareStresser service ‘was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide.’ That scale puts it firmly among the more consequential booter operations law enforcement has dismantled in recent years.
It is worth noting this is not NightmareStresser’s first brush with the authorities. In December 2022, the Department of Justice took down the nightmare-stresser[.]com domain and arrested six suspects who allegedly owned multiple DDoS-for-hire services. The platform (or an iteration of it) apparently continued operating or re-emerged, which is a pattern distressingly common in the booter ecosystem.
NightmareStresser DDoS takedown within the wider Operation PowerOFF campaign
Operation PowerOFF has been running since December 2018, when it began with the seizure of 15 websites linked to DDoS-as-a-service platforms. Since then it has grown into a sustained, multi-agency campaign with an increasingly broad reach. Previous actions under its banner include the takedown of the DigitalStress DDoS-for-hire service in the United Kingdom, the seizure of the Dstat.cc DDoS review platform, and the arrest of two stresser service operators in Poland.
In separate enforcement waves, law enforcement under the operation also seized 13 domains and, in a further action, 48 more domains hosting booter platforms. Last year, Polish authorities detained four suspects linked to six DDoS-for-hire platforms behind thousands of attacks targeting schools, government services, businesses, and gaming platforms worldwide since 2022, while the US simultaneously seized nine domains in the same coordinated crackdown.
The latest action goes beyond domain seizures. According to Infosecurity Magazine, the operation also resulted in the removal of more than 100 URLs advertising DDoS-for-hire services from search engine results. That detail matters: search visibility is how many of these platforms find new customers, and scrubbing them from results cuts off a key acquisition channel even for services that manage to stay online or resurface under a new name.
The demand side of the booter market is unlikely to vanish overnight, and the supply side has shown a stubborn ability to regenerate. But Operation PowerOFF’s accumulation of seizures, arrests, and now search de-indexing suggests a strategy that is at least making the ecosystem more expensive and more dangerous to operate, which is, realistically, the most that sustained law enforcement pressure tends to achieve against decentralised criminal infrastructure. The next coordinated enforcement wave under the operation is already a matter of when, not if.
