The FBI, working with the Royal Canadian Mounted Police, has seized the domains behind NightmareStresser, one of the longest-running DDoS-for-hire platforms on the internet. The action is part of Operation PowerOFF, a multi-year international campaign against booter and stresser services, and both nightmare-stresser.com and nightmarestresser.org now display law-enforcement seizure notices instead of a checkout page.
A service built for scale, not sophistication
NightmareStresser had been running since at least 2022, with research suggesting its actual roots go back to 2016 and a growth spurt in 2018 once competing services got knocked offline. By 2025 it had grown to nearly a million registered users, most of them paying a few dollars a month for the ability to knock a website, a game server, or a rival offline on demand.
That is the part worth sitting with: DDoS-for-hire does not require any skill from the person renting the attack. The barrier to entry has been a subscription fee for years, long before anyone started talking about AI lowering the bar for attackers. Operation PowerOFF has now led to charges against a dozen defendants and over a hundred domain seizures across eight years, and NightmareStresser is simply the latest and one of the largest names on that list.
What to do now
- One booter service going offline does not mean the market did. Assume your public-facing services remain a target and pressure-test what actually happens under sustained load with external network penetration testing that includes availability and rate-limiting checks, not just injection bugs.
- Review upstream protections: is traffic actually routed through a scrubbing provider or CDN, or does your real origin IP leak through a misconfigured DNS record, a forgotten subdomain, or a direct-to-origin API endpoint?
- If your business would take real financial or reputational damage from a few hours of downtime, that risk belongs in the same conversation as ransomware. A ransomware readiness assessment covers the same muscle: do you have a plan, and have you actually rehearsed it, or does it only exist on paper.
The takeaway
Taking down one DDoS-for-hire brand barely dents total capacity across the underground market, since a new domain and a rebrand cost the operators almost nothing. The seizure is still good news. It just should not be the reason anyone feels safer about their own exposure to the next stresser service that has not been shut down yet.