Law enforcement teams have completed an intense week of action against illegal DDoS-for-hire services as part of the long-running Operation PowerOFF. This joint operation comprises teams from 21 countries and targets services that facilitate Distributed Denial-of-Service (DDoS) attacks.
According to Europol, the latest crackdown happened on 13 April 2026, in which officials tracked down the people actually paying for these attacks.
The sites offering DDoS-for-hire services are also called “booters” or “stressers” because they allow anyone, even people who know almost nothing about computers, to launch a DDoS for a tiny fee. This recent operation led to four arrests and the seizure of 53 web domains used by hackers.
“DDoS-for-hire is one of the most prolific and easily accessible trends in cybercrime, enabling individuals with little technical knowledge to follow step-by-step tutorials to execute criminal attacks. These attacks inflict significant harm on businesses and individuals across the globe by targeting servers, websites, or online services and making them inaccessible to legitimate users,” Europol explained in the press release.
Millions of Accounts Found in Databases
This effort relied heavily on Europol, which helped sift through mountains of seized data. The investigation showed that authorities found details on over 3 million criminal user accounts. However, apart from making arrests, the police are also trying to stop the problem before it starts. They sent out over 75,000 warning letters and emails to people who were caught using these services.
The idea is to warn young people and hobbyists that what they are doing is a serious crime. Officials are even running ads on Google so that when someone tries to find these services, they see a message from the law instead. They are even tracking payments through the blockchain to send warnings to those trying to pay with crypto.
A Long Fight
Operation PowerOFF isn’t new; it has been hunting for these groups for years, and Hackread.com has been covering its every achievement over the years. In 2018, authorities successfully shut down Webstresser.org, a site with 136,000 users that had launched 4 million attacks.
This was followed by the seizing of sites like IPStresser.com in 2022 and over a dozen domains hosting DDoS for-hire services in 2023 by the US Department of Justice (DoJ). The pressure continued in 2024, leading to law enforcement from 15 countries shutting down 27 more websites, including zdstresser.net and orbitalstress.net. During that time, three people were arrested in France and Germany.
Then, in May 2025, Polish police joined the operation and arrested four people for running platforms like Cfxapi, where an attack cost as little as €10. More recently, in March 2026, agencies stopped four major botnet networks, including Aisuru, KimWolf, JackSkid, and Mossad, that hackers used to flood websites with traffic.
Nevertheless, by seizing the servers and databases that cyber criminals rely on, authorities cannot fully stop DDoS attacks, but they aim to make it far more difficult to knock business or government sites offline.
