FBI Seizes NightmareStresser Domains After Hundreds of Thousands of DDoS Attacks

NightmareStresser, a long-running distributed denial-of-service (DDoS) “booter” service, has been disrupted in an international law-enforcement operation. The US Department of Justice said the FBI seized domains associated with the service; visitors to nightmare-stresser[.]com and nightmarestresser[.]org now see a seizure banner. Authorities said the service had operated since at least 2022 and had been used to launch hundreds of thousands of DDoS attacks against victims worldwide.

The operation formed part of Operation PowerOFF, a coordinated effort targeting DDoS-for-hire infrastructure and the people operating or using it. Security researcher Alex Carter reported last year that the service may have been founded in 2016, became prominent in 2018 and was the largest DDoS tool in 2019. By 2025, the researcher estimated it had nearly 1 million users and could conduct 3,000 to 4,000 attacks an hour. The service accepted cryptocurrency and reportedly excluded government, education and hospital domains.

The US Department of Justice said it had charged 12 DDoS attack facilitators and seized more than 100 domains linked to booter services over the previous eight years. In April, authorities in 21 countries disrupted 53 related domains. The latest action disrupts NightmareStresser’s publicly identified domains, while the article does not provide details of arrests or confirm whether other infrastructure remains active.