More than 75,000 suspected users of DDoS-for-hire services were targeted during a coordinated international police operation involving 21 countries, and backed by Europol.
The action week took place on 13 April 2026 and led to four arrests, as well as 25 search warrants and the takedown of 53 domains, Europol reported in a statement on Thursday.
More than 75,000 warning emails and letters were sent to identified users during the operation.
The participating countries were Australia, Austria, Belgium, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Sweden, Thailand, the United Kingdom and the United States.
DDoS — short for “distributed denial-of-service” — is a type of cyber attack that overwhelms a website, server or network with traffic and can make it unavailable to legitimate users.
Operation PowerOFF: targeting DDoS-for-hire services
Authorities also carried out preparatory “operational sprints” that focused on high-value target users of DDoS-for-hire platforms and on raising awareness that using these services is illegal, Europol said.
During those sprints, countries disrupted so-called “booter services”, which allow users to pay to launch DDoS attacks, and dismantled infrastructure used to run them.
Seized databases enabled Europol experts to support national authorities with data on more than three million criminal user accounts, which fed into coordinated actions during the April action week.
Europol described Operation PowerOFF as an ongoing international effort to dismantle DDoS-for-hire infrastructure and said it has entered a “prevention phase” that includes search engine adverts aimed at young people looking for such tools, the removal of more than 100 URLs from search results, and warning messages posted on blockchains used for related payments.
