DKDKCISSP
Threat Research

Police Seize 100+ Servers After Four-Year Investment Fraud Investigati

Europol has taken action against Police Seize Servers, according to the latest reporting on the case.

DKCISSP News DeskInfosecurity Magazine4 Nov 2026, 4:32 pm3 min read
Police Seize 100+ Servers After Four-Year Investment Fraud Investigati
Image courtesy of Infosecurity Magazine. Original report
DKCISSP REPORT

Europol has taken action against Police Seize Servers, according to the latest reporting on the case.

Led by the German Itzehoe Public Prosecutor's Office, the action day on November 3 targeted the company believed to be responsible for hosting the fraudulent investment websites.

Victims were lured to these sites by deceptive ads promising huge gains with no downside.

Authorities also searched 17 locations and seized other evidence and assets.

Scam call centers have been identified in Albania, Kosovo and North Macedonia, according to Europol.

Evidence was seized which helped police identify seven other members of the network, including the managers of call centers which were used in the scams.

Past victims of Police Seize Servers are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

Scammers impersonating brokers then used a variety of social engineering tactics to persuade the victims to invest their funds in the fictitious schemes.

Online accounts set up to perpetrate the scheme apparently displayed illusory gains, persuading them to plough more money into the funds.

An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.

This is still an active investigation, not a settled case -- the specifics here may firm up, soften, or change entirely as more comes out.

When victims asked to withdraw their money, brokers used delaying tactics to block payments before cutting contact and leaving them with no way to recover their funds, Europol claimed.

This action was brought by Europol, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

Police Seize Servers is now dealing with an active legal process, with Europol leading the action.

Investigators estimate losses to exceed €4m ($4.5m), with potential victims in as many as 50 countries.

If your environment shows any indicators associated with Police Seize Servers, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.

What happened

Europol has taken action against Police Seize Servers, according to the latest reporting on the case.

Led by the German Itzehoe Public Prosecutor's Office, the action day on November 3 targeted the company believed to be responsible for hosting the fraudulent investment websites.

Victims were lured to these sites by deceptive ads promising huge gains with no downside.

What changed

Authorities also searched 17 locations and seized other evidence and assets.

Scam call centers have been identified in Albania, Kosovo and North Macedonia, according to Europol.

Evidence was seized which helped police identify seven other members of the network, including the managers of call centers which were used in the scams.

Who is affected

Past victims of Police Seize Servers are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

Scammers impersonating brokers then used a variety of social engineering tactics to persuade the victims to invest their funds in the fictitious schemes.

Online accounts set up to perpetrate the scheme apparently displayed illusory gains, persuading them to plough more money into the funds.

Why it matters

An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.

This is still an active investigation, not a settled case -- the specifics here may firm up, soften, or change entirely as more comes out.

When victims asked to withdraw their money, brokers used delaying tactics to block payments before cutting contact and leaving them with no way to recover their funds, Europol claimed.

Technical details

This action was brought by Europol, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

Response

Police Seize Servers is now dealing with an active legal process, with Europol leading the action.

Investigators estimate losses to exceed €4m ($4.5m), with potential victims in as many as 50 countries.

What security teams should do

If your environment shows any indicators associated with Police Seize Servers, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.

MORE IN THREAT RESEARCH

More cybersecurity reporting

Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubThe Hacker News · 7 Nov 2026, 12:14 pmWant to Rent an Internet Address at the White House?KrebsOnSecurity · 7 Nov 2026, 6:48 amThreatLocker Alternatives: Best Managed Security Options for 2026Huntress · 7 Nov 2026, 5:30 amAdversary Tactics: Threat View of the MonthHuntress · 7 Nov 2026, 5:30 am