Thai authorities have arrested a 27-year-old German national suspected of operating major DDoS-for-hire platforms, following a multi-year international investigation involving European law enforcement and INTERPOL.
The suspect, identified as Noah Christopher, was detained in Bangkok’s Thong Lo district during a joint operation by Thailand’s Cyber Crime Investigation Bureau (CCIB) and Immigration Bureau. The arrest was executed under an INTERPOL Red Notice and is linked to 74 outstanding warrants in Germany. The arrest was reported in detail in the Bangkok Post.
Long-running operation of Fluxstress and Netdowner
Investigators allege that Christopher was behind the operation of two well-known DDoS-for-hire services, Fluxstress and Netdowner (also referred to as Neldowner in some reports). The platforms were active between 2021 and 2025 and formed part of a broader cybercrime-as-a-service model.
These services enabled customers globally to launch DDoS attacks against targets of their choosing. Users reportedly paid fees—often in cryptocurrencies such as Bitcoin—to generate large volumes of malicious traffic designed to overwhelm servers and disrupt online services.
Authorities state that the platforms significantly lowered the technical barrier required to execute DDoS attacks, making them accessible to non-technical users and contributing to a wide range of incidents, including attacks against businesses and public sector organisations.
Arrest follows international manhunt
Christopher is believed to have evaded authorities for several years, reportedly moving between countries, including the United Arab Emirates and China, before settling in Thailand. He had been residing in a high-end apartment in Bangkok and had reportedly travelled in and out of the country over a two-year period.
German federal authorities ultimately traced his location and coordinated with Thai police to carry out the arrest. Thai immigration officials revoked his visa shortly before the operation.
Equipment seized, investigation ongoing
During the raid, authorities seized multiple electronic devices, including computers, smartphones, tablets, and a hardware cryptocurrency wallet. Digital forensics teams are currently analysing the equipment for evidence, including potential links to additional suspects and attack activity.
Officials have indicated that the seized data may provide insight into the infrastructure behind the DDoS platforms, customer activity, and possible target lists.
Services may still be active
Despite the arrest, there are indications that parts of the infrastructure may remain operational. Independent researchers have suggested that at least one of the platforms, Fluxstress, was still accessible following the arrest, raising questions about the resilience and decentralisation of such services.
Thai authorities are also examining whether any attacks were launched from within the country during the suspect’s residence.
Extradition proceedings underway
Christopher remains in custody in Thailand pending extradition to Germany, where he is expected to face multiple charges related to cybercrime operations, including running platforms that facilitate DDoS attacks and other forms of online disruption.
The case highlights the continued global nature of DDoS-for-hire ecosystems and the role of international cooperation in identifying and apprehending operators behind them.
