FBI and RCMP seize NightmareStresser DDoS-for-hire domains in Operation PowerOFF

The US DOJ announced the court-authorized seizure of NightmareStresser's domains, a booter service blamed for hundreds of thousands of DDoS attacks since 2022, executed by FBI Anchorage with RCMP support under Operation PowerOFF.

On 2026-09-17 the US Department of Justice announced the court-authorized seizure of the nightmare-stresser[. ]com and nightmarestresser[. ]org domains used by NightmareStresser, one of the longest-running DDoS-for-hire ('booter') services. The seizure was executed by the FBI Anchorage field office with support from the Royal Canadian Mounted Police (Federal Pollicing Northwest Region), announced from the District of Alaska, where prosecutors Adam Alexander and Ainsley McNerney are handling the case; a seizure notice now appears on the domains. According to a DOJ seizure-warrant affidavit, the service enabled hundreds of thousands of actual or attempted DDoS attacks worldwide since at least 2022, with victims including educational institutions, government agencies, businesses, gaming platforms, and millions of individuals, including users in Alaska, the wider US and internationally. Reports differ on the service's scale: Searchlight Cyber reported in 2023 that NightmareStresser had over 566,000 registered users and 52 dedicated servers launching attacks of up to 200 Gbps against Layer 4 and Layer 7 targets; SecurityWeek reports it reached nearly 1 million users by 2025, could launch 3,000-4,000 attacks per hour, accepted cryptocurrency and was possibly founded in 2016; CyberScoop notes the service itself claimed only tens of thousands of users and ran an affiliate program, openly marketing illegal use cases and claiming to operate under Russian law. The action is part of Operation PowerOFF, a multinational campaign coordinated with Europol's EC3 and JCAT that began in December 2018; over the past eight years it has charged 12 DDoS facilitators and seized more than 100 booter domains, with earlier waves taking down DigitalStress, Dstat.cc, 53 domains across 21 countries in April, and 27 booter sites in December 2024. No arrests or charges tied specifically to this action were disclosed and the operators remain unidentified; BleepingComputer additionally reports that a December 2022 DOJ takedown previously seized the .com domain and arrested six suspects. The DOJ warns that users of such services face CFAA prosecution, device seizures, fines and imprisonment, while experts expect a Whac-A-Mole-style resurgence of booter services.