ThreatPaper
Assessed, Not Confirmed

NightmareStresser had 566,000+ registered users

Assessment

The figure comes from a late-2023 Searchlight Cyber report, cited by multiple outlets covering the September 2026 seizure, and describes cumulative registered signups nearly three years before takedown — not a government-confirmed count and not necessarily the active customer base at the time of seizure. A separate, independent researcher's estimate given to CyberScoop the same week put realistic active usage at "tens of thousands."

Where this claim appeared

The Hacker News (citing Searchlight Cyber) · 2026-09-17

https://thehackernews.com/2026/09/us-seizes-nightmarestresser-domains.html

What “Assessed, Not Confirmed” means

A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.

4 of 5 · rating scale

Assessed in

NightmareStresser DDoS-for-hire domains seized — the same brand the FBI already took down once

Think this assessment is wrong? Report an error.