FBI has seized the domains of 15 high-profile DDoS-for-hire websites, including downtime.org and deacon.pro, and charged 3 men in US with operating the sites
Context & Ripple Effects
This seizure lands mid-arc in an FBI campaign against 'booter' services that began years earlier: the alleged co-owners of the vDOS service were arrested in Israel after the service itself was hacked, and the WebStresser takedown removed a service with 136K users that rented attacks for as little as $14.99. The December 2018 action against downtime.org, deacon.pro, and 13 other domains extends the same playbook from single services to a batch of fifteen at once.
The pattern held afterward: within weeks the FBI and EU partners took down xDedic, a marketplace for access to hacked servers, and four years later the DOJ escalated to seizing 48 booter sites and charging six people. The 2018 action reads as the moment batch-seizure became standard operating procedure.
First-order effects
- Customers of downtime.org and deacon.pro immediately lose their attack-for-rent infrastructure, and the three charged US operators face prosecution for running all fifteen sites.
- The FBI gains a public demonstration that renting DDoS capacity carries criminal exposure for buyers and operators alike, not just for the underlying attackers.
Second-order effects
- Demand does not disappear — it migrates to surviving booter services or to privately built botnets, which is why the DOJ had to seize another 48 sites in 2022 and later disrupt botnets like Aisuru and Kimwolf behind record-scale attacks.
- Rival underground marketplaces such as xDedic come under the same cross-border template, as shown by the joint FBI-EU server seizure weeks later.
Third-order effects
- If the pattern holds, DDoS-for-hire becomes a permanently contested market where each takedown raises prices and operational risk rather than eliminating supply, pushing enforcement toward the botnet infrastructure upstream.
- The recurring multi-country seizure model — US charges plus domain and server actions abroad — hardens into the default structure for policing criminally rented cyber capabilities.
The trend: Law enforcement has shifted from one-off takedowns of individual booter services to a repeating, internationally coordinated seizure cycle aimed at the entire DDoS-for-hire supply chain.