NightmareStresser DDoS-for-hire domains seized — the same brand the FBI already took down once

Executive Summary

On 15 September 2026 the FBI's Anchorage Field Office and the Royal Canadian Mounted Police seized the domains nightmare-stresser[.]com and nightmarestresser[.]org, taking offline a DDoS-for-hire "booter" service that, by the government's own account, had been used to launch hundreds of thousands of actual or attempted denial-of-service attacks against victims worldwide since at least 2022¹. The action is the latest wave of Operation PowerOFF, a joint FBI-Europol effort against booter and stresser services that began in 2018 and has now charged twelve defendants and seized more than 100 domains¹².

No one was arrested in this specific action, and the Justice Department did not name an operator or state a country of origin¹. A threat researcher who spoke to press on the record filled in what the government didn't: NightmareStresser's own marketing claimed the service operated under the laws of the Russian Federation — a jurisdictional shield that, if true, makes prosecuting whoever ran it considerably harder even if they're identified³. That marketing was aggressive and specific. The service advertised itself, on its own now-seized website, as "the only DDoS tool available 24x7, running non-stop for over 8 years" and boasted "no vanishing acts, no broken promises." One outlet's reporting states plainly that this claim is false on its face: a domain linked to NightmareStresser was already seized once before, in the December 2022 wave of the same operation⁴. Whatever ran under that name in September 2026 either survived that seizure under a different domain or rebuilt itself afterward — either way, "never went down" describes a service that the FBI had already taken down once.

The scale, per a late-2023 report from threat intelligence firm Searchlight Cyber that multiple outlets cite, was substantial for a service of this kind: more than 566,000 registered users and 52 dedicated servers capable of Layer 4 (UDP/TCP) and Layer 7 attacks up to 200 Gbps, sold with cryptocurrency payment and a referral program that paid users for every renewal or purchase made by people they'd referred, indefinitely⁴⁵. A researcher interviewed by CyberScoop put the more usual scale of a service like this in context differently — "tens of thousands" of active users, mostly "script kiddies... oftentimes for pranks" — a real tension between the vendor-reported historical high-water mark and what a working botnet-for-hire's active user base typically looks like day to day³.

Verification of Claims

1. Claim: NightmareStresser had "more than 8 years" of continuous uptime with "no vanishing acts." → False → This is the service's own marketing copy, preserved and quoted by The Hacker News from the seized site before takedown⁴. The same report states that a domain linked to NightmareStresser ("nightmarestresser[.]com") was already among the 48 domains seized in the December 2022 wave of Operation PowerOFF⁴⁶. A service whose domain has already been seized by the FBI once cannot honestly claim it has never gone down; at minimum, the operators either lost and regained control of that domain, or migrated to a new one and inherited the brand, neither of which is "no vanishing acts."

2. Claim: NightmareStresser had 566,000+ registered users. → Assessed, Not Confirmed → Sourced to a late-2023 report by Searchlight Cyber, cited via The Hacker News and Help Net Security⁴⁵. The figure is a vendor's historical assessment from nearly three years before the September 2026 seizure, not a court-established or government-confirmed count, and does not distinguish active users from cumulative signups. CyberScoop separately reported a threat researcher's estimate of "tens of thousands" of actual users, a meaningfully smaller figure describing current rather than cumulative usage³.

3. Claim: NightmareStresser operated under Russian jurisdiction. → Unverified → Reported by CyberScoop, attributed to the service's own claims as relayed by Infoblox threat researcher Zach Edwards, not to any government confirmation: "the service claimed it operated under the laws of Russia"³. The Justice Department's press release does not name a country of origin or an operator¹. This is the operators' own unverified assertion, useful context for why enforcement stopped at a domain seizure rather than an arrest, but not established fact.

Timeline

Operation Anatomy

The service

NightmareStresser presented itself publicly as a stress-testing tool, the standard fig leaf booter services use to avoid outright admitting illegality, while its own site content contradicted that framing directly: "advanced Layer 4 amplification methods and various bypasses at Layer 4 over UDP/TCP and Layer 7, claiming they can defeat CAPTCHAs, geoblocks, and rate limits"⁴. Per Searchlight Cyber's 2023 assessment, the backend ran on 52 dedicated servers, offered attacks up to 200 Gbps, and gave customers a control panel to select target IP or URL, port number, and number of concurrent attacks⁴⁵. A "Stop All" button let a customer halt every running Layer 4 or Layer 7 flood with one click⁴. Payment was accepted in cryptocurrency, and an "advanced referral system" paid the referring user credit for every purchase or renewal their referral made, "over time" — a recurring-revenue affiliate structure more commonly associated with legitimate SaaS products than criminal infrastructure⁴.

Infrastructure

Internet Archive snapshots examined by The Hacker News show the nightmarestresser[.]org domain was itself protected against DDoS attacks by a commercial web infrastructure provider, BlazingFast — a booter service paying a third party to keep its own storefront online against the very kind of attack it sold⁴.

Victims

The Justice Department describes the victim population broadly: "educational institutions, government agencies, gaming platforms and millions of people," both in the District of Alaska and worldwide¹. No specific named victim organization or incident is cited in the government's release; this is a characterization of the service's customer base's targeting pattern, assessed from the seizure warrant affidavit, not a list of confirmed victims.

Threat Actor Profile

• Name: NightmareStresser (self-branded). No operator named by any government source reviewed¹³.
• Attribution confidence: None established by law enforcement. The claim of Russian jurisdiction is the operators' own marketing, relayed by a private researcher, not a government finding³.
• Motivation: Financial — a subscription/pay-per-attack booter business with a referral-based growth model, not an ideologically motivated actor⁴.
• Customer base (not the operators themselves): Per CyberScoop's source, predominantly "script kiddies... oftentimes for pranks or for some sort of obscure political agenda," historically concentrated against gaming servers and streamers³.
• Operational history: At least since 2022 under the NightmareStresser name per DOJ's affidavit-sourced assessment¹; the brand's own claim of "8 years" would place its origin closer to 2018, coinciding with Operation PowerOFF's own start date — unverified, but not implausible for a service of this type¹²⁴.

MITRE ATT&CK (IDs checked live on attack.mitre.org, 18 September 2026):

This entry describes the service NightmareStresser sold to its customers, who are the actual technique operators in each attack; the platform itself is infrastructure-for-hire rather than a single intrusion campaign.

Technical Indicators

seized_domains:
  - "nightmare-stresser[.]com"
  - "nightmarestresser[.]org"
infrastructure_provider_named_in_reporting:
  - "BlazingFast (DDoS protection for nightmarestresser[.]org, per Internet Archive snapshots)"
prior_related_seizure:
  - "nightmarestresser[.]com — reported among the 48 domains seized in the December 2022 wave of Operation PowerOFF"
seizure_statutory_basis:
  - "18 U.S.C. § 981(a)(1)(A) and (b) — civil forfeiture of property involved in money laundering / traceable to unlawful activity"
  - "18 U.S.C. § 982(b)(1) — criminal forfeiture procedures"
  - "18 U.S.C. § 1030(i)(1)(A) — forfeiture under the Computer Fraud and Abuse Act"
  - "21 U.S.C. § 853 — criminal forfeiture procedures (incorporated by reference)"
scale_reported_by_searchlight_cyber_2023:
  registered_users: "566,000+"
  dedicated_servers: 52
  max_advertised_throughput: "200 Gbps"
  layers_targeted: ["Layer 4 (UDP/TCP)", "Layer 7"]
network_iocs: none disclosed beyond the seized domains
file_hashes: none disclosed — this is a web-based subscription service, not malware

Legal and Regulatory Response

Seizure. Court-authorized seizure warrant issued by the US District Court for the District of Alaska, executed 15 September 2026 by FBI Anchorage Field Office in coordination with the Royal Canadian Mounted Police, Federal Policing Northwest Region¹. No indictment or arrest was announced alongside this specific seizure¹.

Prosecutors. Assistant US Attorneys Adam Alexander and Ainsley McNerney, District of Alaska¹.

Program context. Operation PowerOFF is a standing joint effort among the FBI, Europol, the Dutch National Police, Germany's Federal Criminal Police Office, Poland's Cybercrime Police and the UK National Crime Agency, running since December 2018². Prior waves: December 2018 (15 domains, with the Dutch National Police); December 2022 (48 domains, 6 US defendants charged, including a domain linked to NightmareStresser)⁴⁶; May 2023 (13 more domains)²; December 2024 (further takedowns)²; April 2026 (53 domains disrupted, 4 arrests, more than 75,000 users affected, per Europol)⁴. Total across the program to date: more than 100 domains, twelve defendants charged¹.

No named defendant in this action. The DOJ release states the investigation "builds on the success of prior cases by targeting all known booter sites, shutting down as many as possible, and undertaking a public education campaign" — language describing an infrastructure-disruption and deterrence strategy rather than an imminent prosecution¹.

Impact Assessment

• Domains seized in this action: Confirmed, 2 (nightmare-stresser[.]com, nightmarestresser[.]org)¹⁴.
• Attacks attributed to the service since 2022: Reported, "hundreds of thousands of actual or attempted" attacks, per the FBI's seizure warrant affidavit¹.
• Registered users: Reported (vendor estimate, late 2023), 566,000+⁴⁵; separately estimated as "tens of thousands" active by an independent researcher speaking in September 2026³.
• Operators identified or arrested: None, as of this action¹³.
• Total domains seized under Operation PowerOFF to date: Confirmed, more than 100, across all waves since 2018¹.
• Total defendants charged under Operation PowerOFF to date: Confirmed, 12¹.
• Whether the takedown will meaningfully reduce booter-service availability: Assessed, unlikely to be durable — per the CyberScoop-quoted researcher, "these booter services are like playing a game of Whac-A-Mole... these underground networks quickly shift to new providers when one is taken down"³.

Lessons and Defensive Recommendations

For organizations that might be targeted

• Booter-service customers overwhelmingly target gaming platforms, streamers, schools and public-sector sites — categories that often lack enterprise-grade DDoS mitigation. If your organization fits one of those categories, standing DDoS protection (not an incident-response plan you'll set up after the first attack) is the actual mitigation; law enforcement seizures of booter infrastructure are welcome but, per the researcher record here, not durable.
• A referral-driven, subscription-based booter service is a business, and businesses have customer lists, payment records and infrastructure vendors. Domain seizure notices are a useful signal to check whether your organization was named as a target in any subsequently unsealed affidavit.

For platforms and infrastructure providers

• BlazingFast (or any DDoS-protection provider) protecting a service that is itself a DDoS-for-hire storefront is a detectable pattern: a "stress testing" customer whose own traffic profile looks like it needs enterprise DDoS mitigation is a red flag worth screening for at onboarding.
• Cryptocurrency payment plus an uncapped, indefinite referral-commission structure is a recognizable criminal-service business model, not just a booter-specific one; the same pattern shows up in access-broker and DDoS markets alike, and is a useful heuristic for infrastructure abuse teams.

For researchers and journalists

• Treat a criminal service's self-reported uptime and scale claims exactly as skeptically as any other advertising copy. In this case the claim was directly falsifiable against the government's own prior seizure record, and nobody at the point of initial coverage flagged the contradiction — it took a follow-up piece cross-referencing Internet Archive snapshots against a 2022 DOJ release to catch it⁴⁶.
• Vendor-reported user counts (here, Searchlight Cyber's 566,000 figure) and researcher field estimates ("tens of thousands" active) are answering different questions — cumulative signups versus a working criminal customer base — and conflating them overstates or understates the service's real reach depending on which framing a story leads with.

Sources