U.S. Seizes NightmareStresser DDoS-for-Hire Domains in Operation PowerOFF

The U.S. DOJ, FBI Anchorage Field Office, and Royal Canadian Mounted Police seized nightmare-stresser[.]com and nightmarestresser[.]org, disrupting a long-running DDoS-for-hire ('booter') service linked to hundreds of thousands of attacks since 2022;…

The U.S. Department of Justice announced a court-authorized seizure of nightmare-stresser[.]com and nightmarestresser[.]org, the domains behind NightmareStresser, one of the longest-running DDoS-for-hire ('booter') services, allegedly used to launch hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022. The seizure was executed by the FBI Anchorage Field Office with Royal Canadian Mounted Police support under a U.S. District Court for Alaska warrant, as part of Operation PowerOFF, the international effort running since December 2018. A 2023 Searchlight Cyber report put the service at 566,000+ registered users and 52 servers capable of attacks up to 200 Gbps using Layer 4 amplification and Layer 7 floods, though the service itself claimed only tens of thousands of users — a discrepancy between sources. Victims spanned schools, government agencies, businesses, gaming platforms, and millions of individuals. Over the past eight years, Operation PowerOFF prosecutors have charged twelve defendants and seized more than 100 booter domains across waves including 48 domains in December 2022, 27 sites in December 2024, and 53 domains across 21 countries with four arrests in April 2026; operators remain unidentified and experts expect a possible 'Whac-A-Mole'-style resurgence.

• Seized domains: nightmare-stresser[.]com and nightmarestresser[.]org, taken under a U.S. District Court for Alaska warrant; executed by the FBI Anchorage Field Office with RCMP technical and investigative support; a seizure notice now…
• NightmareStresser was a 'booter'/DDoS-for-hire service allegedly used for hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022.
• A 2023 Searchlight Cyber report credited the service with 566,000+ registered users and 52 dedicated servers launching attacks of up to 200 Gbps; the service itself claimed only tens of thousands of users (sources disagree on user count).
• Capabilities included Layer 4 amplification, Layer 7 floods, CAPTCHA and rate-limit bypasses, and rented botnets of compromised routers and IoT devices; it offered an affiliate program and openly marketed illegal use cases, claiming to…
• Victims included educational institutions, government agencies, businesses, gaming platforms, and millions of individuals.
• Operation PowerOFF began in December 2018; over the past eight years prosecutors have charged twelve defendants and seized more than 100 booter domains (BleepingComputer separately cites 60+ domains from earlier waves).
• Prior waves: 48 domains seized in December 2022 (BleepingComputer reports six suspects arrested in that wave), 27 booter sites in December 2024, and 53 domains across 21 countries with four arrests in April 2026; earlier takedowns included…
• Operators of NightmareStresser remain unidentified.