US Seizes NightmareStresser Domains Used in Global DDoS Attacks

The US Justice Department has seized the internet domains associated with NightmareStresser, a long-running DDoS-for-hire service, as part of Operation PowerOFF. The court-authorised action was led by the FBI’s Anchorage Field Office with support from the Royal Canadian Mounted Police’s Federal Policing Northwest Region. It prevents customers from using the service to launch attacks against targets in Alaska and worldwide.

According to the DOJ, an affidavit supporting the seizure says NightmareStresser was used for hundreds of thousands of actual or attempted distributed denial-of-service attacks against victims globally since 2022. Booter or stresser services allow customers to pay to disrupt online systems, often without technical expertise; affected organisations can include schools, government agencies and gaming platforms, while attacks may degrade or completely interrupt internet services. The article does not report confirmed exploitation of a software vulnerability, but describes the service’s alleged role in facilitating attacks.

The seizure is part of a wider international campaign against DDoS-for-hire operators. The DOJ said a coordinated action in April across 21 countries took down 53 domains, led to four arrests and prompted warning letters to more than 75,000 identified users. In December 2024, another Operation PowerOFF action removed 27 booter sites. Prosecutors said previous investigations involving Anchorage and Los Angeles had charged 12 defendants and seized more than 100 related domains.

Authorities acknowledge that replacement services can emerge quickly and say the current investigation aims to identify and shut down as many known booter sites as possible.