Law enforcement agencies from 21 countries sent warning messages to more than 75,000 people suspected of using DDoS-for-hire services during a coordinated action week in April 2026. Europol, which supported the operation, announced Operation PowerOFF‘s results on April 16. The operation resulted in four arrests, 53 domain seizures, and 25 search warrants executed across participating nations.
Belgium and the Netherlands were among the European participants. Australia, Austria, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, Norway, Poland, Portugal, Sweden, Thailand, the United Kingdom, and the United States also joined the week-long effort.
What are booter services
Booter services, also called stresser services, let anyone rent DDoS attack capacity and direct it at websites, servers, or networks. Buyers need no technical knowledge. These platforms provide step-by-step tutorials that walk customers through launching an attack against any target they choose.
Europol identified several categories of users. Some act out of curiosity. Others are motivated by hacktivism or ideological goals. A significant portion use these services for financial extortion, demanding payment to stop an ongoing attack. Others aim to knock competitor services offline at critical moments.
The scale of demand is visible in the numbers from Operation PowerOFF. Seized databases gave investigators access to records on more than three million criminal user accounts across multiple platforms. Europol analyzed that data, geolocated users, and distributed intelligence packages to law enforcement in each participating country. National agencies then sent warning letters or emails to individuals identified as customers.
Operation PowerOFF goes beyond arrests and takedowns
Arrests and domain seizures were only part of the action. Authorities removed more than 100 URLs promoting DDoS-for-hire services from search engine results, limiting how easily newcomers can find them. Ad campaigns targeting people actively searching for attack tools also ran on major search engines, pointing toward the legal consequences of use.
Warning messages also reached users through blockchains used to process criminal payments. Contacting 75,000 identified users means law enforcement holds their data, and continued activity carries a real risk of prosecution.
Europol’s role in Operation PowerOFF
Europol provided support throughout Operation PowerOFF’s action week. The agency analyzed datasets seized from booter operators, ran investigative sprints with national partners, operated a command post during enforcement days, and provided forensic and cryptography assistance. Each participating country handled local arrests, search warrants, and user outreach.
Operation PowerOFF has run multiple phases over several years. This action week follows the same model: treating DDoS-for-hire services as an ecosystem problem, targeting both the infrastructure and the customer base at the same time.