The Federal Bureau of Investigation moved to shut down NightmareStresser on Tuesday by seizing the domains that powered one of the world's most persistent DDoS-for-hire operations. These "booter services" function as rental platforms, enabling customers to access compromised routers and Internet of Things devices organized into botnets capable of launching large-scale distributed denial-of-service attacks against websites and online infrastructure.
NightmareStresser marketed itself as the "#1 online IP booter" and claimed to offer "the only DDoS tool available 24/7" before nightmare-stresser[.]com and nightmarestresser[.]org went offline. According to research published by Searchlight Cyber in 2023, the platform boasted more than 566,000 user accounts and operated 52 dedicated servers capable of generating DDoS traffic reaching 200 Gbps, with the ability to target both Layer 7 application-level protocols and Layer 4 transport-layer protocols.
The FBI Cyber Division stated that "Since 2022, the NightmareStresser Booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide." A notice posted on the seized domains indicates that "This enforcement action was supported by Operation PowerOFF, a coordinated effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructures worldwide."
Operation PowerOFF's broader campaign
This takedown represents the latest action in Operation PowerOFF, a sustained international law enforcement initiative that commenced in December 2018 with the seizure of 15 websites connected to DDoS-as-a-service platforms. The Department of Justice had previously targeted nightmarestresser[.]com in December 2022, resulting in the arrest of six individuals accused of operating multiple DDoS-for-hire services.
Throughout its operation, PowerOFF has achieved multiple significant disruptions. Law enforcement shut down the DigitalStress DDoS-for-hire service operating in the United Kingdom and seized the Dstat.cc DDoS review platform. Two stresser service operators faced arrest in Poland. In separate enforcement waves, authorities seized 13 domains and an additional 48 domains hosting booter platforms.
Polish authorities detained four suspects in connection with six DDoS-for-hire platforms last year, following investigations into thousands of attacks launched against schools, government agencies, businesses, and gaming services globally since 2022. Concurrent with this action, the U.S. seized nine additional domains as part of the coordinated crackdown on DDoS services.