US Seizes Nightmare Stresser Domains in DDoS-for-Hire Crackdown

The Justice Department announced the action in a press release earlier this week on the District of Alaska Attorney General’s Office website, according to TechRadar. The two domains were nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to those sites now see an FBI banner stating, “This website has been seized as part of a coordinated law enforcement action taken against illegal DDoS-for-hire services.”

The department said Nightmare Stresser had been used in hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022. Such services are commonly called “booters” or “stressers” and are often marketed as tools for legitimate website stress-testing. Researchers have warned repeatedly that the label can serve as cover for illegal activity. The platforms rent access to anyone, including cybercriminals, and have been used to disrupt businesses, public organizations and individuals, causing reputational and financial harm.

DDoS attacks require infrastructure, typically hundreds of thousands of internet-connected devices infected with malware and instructed to send traffic toward a single target. The Justice Department’s announcement did not say whether any such infrastructure had been dismantled, or whether malware used to create Nightmare Stresser had been discovered or sinkholed. It also did not mention any arrests.

TechRadar reported that the absence of those details suggests Nightmare Stresser could return to operation sooner rather than later. The press release nonetheless said the takedown is part of Operation PowerOFF, which aims to dismantle DDoS-for-hire infrastructure worldwide and to hold accountable the administrators and users of such services. So far, more than 100 domains have been seized as part of the effort and 12 people have been charged.