Europol has successfully dismantled multiple DDoS-for-hire platforms used to carry out thousands of cyberattacks globally. This coordinated crackdown marks a major win in the fight against cybercrime.
As part of the operation, authorities in Poland arrested four suspects. Meanwhile, the U.S. government seized nine domains linked to illegal DDoS services. These actions target services that allowed anyone to rent attack tools for as little as €10.
Powerful DDoS-for-Hire Services Brought Down
According to Europol, the suspects were behind six stresser/booter websites — cfxapi, cfxsecurity, neostress, jetstress, quickdown, and zapcut. These services enabled users to flood websites and servers with fake traffic, making them go offline. Their targets included schools, businesses, government agencies, and gaming platforms between 2022 and 2025.
Unlike traditional botnets, these platforms made it easy for people with zero hacking skills to launch attacks. Users simply selected a target IP address, picked a type of attack, paid a fee, and clicked launch.
These tools often looked professional, with polished dashboards and user-friendly features. Despite appearing like stress-test tools, they were in fact illegal services designed to crash real websites.
Fake Security Services With Real Threats
Some of these platforms even marketed themselves as legitimate. For example, cfxsecurity claimed to be the “#1 stress testing service” and operated on domains like cfxsecurity[.]bet and cfxsecurity[.]cc. Their plans started at $20/month and went up to $130/month.
Another platform, QuickDown, ran on quickdown[.]pro and charged users up to $379/month. According to Radware’s August 2024 report, QuickDown used a hybrid system combining botnets with dedicated servers, making attacks more powerful and harder to stop. In 2023, they even introduced new botnet features and pricing plans.
This latest crackdown is part of Operation PowerOFF, a long-running effort to shut down DDoS-for-hire infrastructure. The operation involves international cooperation, with help from Dutch and German authorities.
Back in December 2024, the campaign disabled 27 other stresser services and led to charges against six people in the Netherlands and the U.S.
Europol’s latest success shows continued commitment to dismantling these cybercrime networks. While DDoS-for-hire platforms are easy to access and use, authorities are working hard to track and eliminate them.
