Criminal Clicks: Global Police Unmask 75,000 Buyers in DDoS-for-Hire Crackdown

When the police come knocking, most expect it’s because of a crime committed in the real world. But last week, thousands of people worldwide received digital warnings for something they might have thought was just a tech prank: paying a few bucks to knock websites offline. The message is clear - cybercrime, even committed from your bedroom, is still crime.

Fast Facts

• Operation PowerOFF involved law enforcement from 21 countries.
• Over 75,000 users of DDoS-for-hire services were identified and directly warned.
• Authorities seized 53 domains offering DDoS attacks and made 4 arrests in April 2026.
• Databases revealed more than 3 million criminal user accounts linked to DDoS activity.
• Officials are targeting both the service providers and the paying customers, including tracking crypto payments.

The digital underworld of DDoS-for-hire, also known as “booters” or “stressers,” has long enabled anyone with a credit card - or even crypto - to unleash disruptive attacks on websites and servers. For as little as €10, users could flood a target with junk traffic, taking down businesses, schools, and even government services. And until recently, many believed they could do so with near-total anonymity.

But Operation PowerOFF, a years-long effort led by Europol and supported by agencies across the globe, has steadily dismantled this illusion. This April, investigators not only shut down dozens of notorious DDoS platforms but also took the unprecedented step of targeting the buyers themselves. Using seized databases and blockchain analysis, officials identified tens of thousands of customers - and sent them direct warnings that their activities had not gone unnoticed.

“DDoS-for-hire is one of the most prolific and easily accessible trends in cybercrime,” Europol stated, highlighting how these services lower the technical barrier for would-be attackers. The authorities’ message, amplified by Google ads and email campaigns, is aimed especially at young people and hobbyists who may not grasp the real-world consequences of these virtual assaults.

This crackdown is only the latest chapter in a long campaign. Since the 2018 takedown of Webstresser.org (with 136,000 users behind 4 million attacks), law enforcement has shuttered dozens of similar sites, arrested operators across Europe, and disrupted major botnets used to automate attacks. Still, the sheer number of user accounts discovered - over 3 million - highlights the scale of the problem.

Authorities acknowledge that wiping out DDoS attacks entirely is nearly impossible. New sites and services pop up as quickly as old ones are seized. But by making it riskier, more complicated, and less anonymous to buy these attacks, police hope to disrupt the business model and cool the market for digital mayhem.

As cybercrime evolves, so too does the response. Operation PowerOFF signals a shift: it’s no longer just the masterminds in the crosshairs, but the everyday online “customers” as well. For anyone tempted by the promise of easy online havoc, the warning is loud and clear - there’s no such thing as a harmless click in the world of cybercrime.

WIKICROOK

• DDoS (Distributed Denial: A DDoS attack overwhelms an online service with traffic from many sources, making it slow or unavailable to real users.
• Booter/Stresser: Booters or stressers are online services that sell DDoS attacks, often pretending to be legitimate network testing tools for websites or servers.
• Botnet: A botnet is a network of infected devices remotely controlled by cybercriminals, often used to launch large-scale attacks or steal sensitive data.
• Blockchain Analysis: Blockchain analysis uses software to trace and analyze transactions on public blockchains, helping detect suspicious or criminal activity and ensure compliance.
• Domain Seizure: Domain seizure occurs when authorities take control of a website's address, often redirecting users to legal notices to combat illegal online activities.