U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks

Cybercrime / DDoS-for-Hire

The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser.

The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the sites are now greeted by a seizure banner that states -

"This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant pursuant to 18 U.S.C. §§ 981(a)(1)(A) and (b), 982(b)(1), and 1030(i) (1)(A); and 21 U.S.C. § 853 issued by the United States District Court for the District of Alaska as part of a joint international law enforcement operation and action by: United States Attorney's Office for the District of Alaska, Federal Bureau of Investigation (FBI) Anchorage Field Office, [and] Royal Canadian Mounted Police (RCMP)."

These so-called booter services are usually advertised as stress testing utilities but have been used to facilitate attacks targeting a broad range of victims in the U.S. and elsewhere, the Justice Department said. Some of the targeted sectors included educational institutions, government agencies, gaming platforms, and millions of people.

"In addition to affecting targeted victims, these attacks can significantly degrade internet services and can completely disrupt internet connections," the DoJ said in a statement.

NightmareStresser is assessed to have been used to launch hundreds of thousands of actual or attempted DDoS attacks against victims across the world since 2022. Snapshots captured by the Internet Archive show that the "nightmarestresser[.]org" domain was secured against DDoS attacks by a web infrastructure provider named BlazingFast.

In a late 2023 report, Searchlight Cyber said NightmareStresser had more than 566,000 registered users and 52 servers, stating the panel allows the attacker to choose the IP address or URL to be targeted as well as the port number, along with options to select the number of concurrent attacks.

On its now-taken-down website, NightmareStresser claimed to be the "only DDoS tool available 24x7, running non-stop for over 8 years." Ironically, the site also proclaimed, "For over 8 relentless years, NightmareStresser hasn't gone down. Not once. No vanishing acts. No broken promises. Just raw, consistent dominance day and night."

Furthermore, NightmareStresser allowed customers to pay in cryptocurrency and featured an "advanced referral system" that made it possible for users to receive credit when their referral link was used by a third party to visit the website, regardless of whether any purchases were made immediately or later. "Referred users are permanently linked to your account, meaning you earn credit for every renewal or purchase they make over time," the website stated.

Services offered by the platform included advanced Layer 4 amplification methods and various bypasses at Layer 4 over UDP/TCP and Layer 7, claiming they can defeat CAPTCHAs, geoblocks, and rate limits. Another feature advertised on its website is a "Stop All" control button that the operators said can be used to stop all Layer 4 or Layer 7 floods.

"No matter how many active floods are running whether on Layer 4 or Layer 7 or both, one click is all it takes to halt them instantly," a web page advertising NightmareStresser's features read. "No searching, no delays, no confusion. Just one button exactly when you need it."

The takedown is part of a long-running effort called Operation PowerOFF, a coordinated law enforcement initiative that's aimed at dismantling criminal DDoS-for-hire infrastructures globally. In December 2022, another domain linked to NightmareStresser ("nightmarestresser[.]com") was among the 48 domains that were seized by the DoJ. 

Earlier this April, a similar operation led to the disruption of 53 domains and the arrest of four people in connection with various commercial distributed denial-of-service (DDoS) services that were used by over 75,000 cybercriminals.

In all, these law enforcement actions have charged twelve defendants who facilitated DDoS-for-hire services and seized more than 100 internet domains linked to them.

"The multi-prong investigation announced today builds on the success of the prior cases by targeting all known booter sites, shutting down as many as possible, and undertaking a public education campaign," the DoJ said.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.