OpenSpy The internet forgot. We kept the receipts.
NetWalker dark-web resource seizure
SEIZED

NetWalker dark-web resource seizure

rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion · pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

ransomware

Last reviewed: 26 July 2026

Summary

Two NetWalker onion addresses are associated with an archived seizure page dated 27 January 2021. The U.S. Department of Justice stated that Bulgarian authorities seized a hidden resource used to provide payment instructions and communicate with victims and that visitors would see a law-enforcement seizure banner.

Current assessment: ONLINE → SEIZED. Supporting sources appear below.

Before and after

BEFORE

AFTER

Law-enforcement seizure notice displayed on NetWalker hidden infrastructure
Captured: 27 January 2021Status: SEIZED Source: Extortion Wiki seizure archive / seized.fyi

Select an available image to open the preserved archive copy.

Status history

  1. ONLINE → SEIZED

    DOJ announced the hidden-resource seizure and stated that visitors would see a seizure banner.

Record details

Domain
rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion, pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Category
ransomware
Current status
SEIZED
Previous status
ONLINE
First seen
Not confirmed
Last seen
Not confirmed
Changed at
27 January 2021
Action type
international infrastructure seizure
Agency
Federal Bureau of Investigation, Bulgarian National Investigation Service, Bulgarian General Directorate Combating Organized Crime
Registrar
Not confirmed
Hosting provider
Not confirmed
Country
United States, Bulgaria, Canada
Related operation
Not confirmed

What happened?

Two NetWalker onion addresses are associated with an archived seizure page dated 27 January 2021. The U.S. Department of Justice stated that Bulgarian authorities seized a hidden resource used to provide payment instructions and communicate with victims and that visitors would see a law-enforcement seizure banner.

No replacement domain or mirror has been confirmed.

Visual similarity alone is not treated as evidence of common ownership. Websites can copy each other. This remains one of the internet’s more dependable features.

Extortion Wiki documents the actor, negotiations, ransom notes, victims, and related ransomware activity.

Open the full Extortion Wiki record →

vx-underground provides malware-family samples and technical research. These links provide family context and do not serve as evidence for the takedown documented above.

OpenSpy stores metadata and research links only. It does not mirror executable malware or sample archives.

Sources

  1. Department of Justice Launches Global Action Against NetWalker Ransomware

    U.S. Department of Justice

    Type: official law-enforcement announcement · Published: 27 January 2021 · Accessed: 26 July 2026

  2. NetWalker website seizure banner

    Extortion Wiki

    Type: verified archive record · Published: 27 January 2021 · Accessed: 26 July 2026

Record quality

Before snapshot
Not preserved
After snapshot
Available
Official confirmation
Not confirmed
Exact takedown time
Not confirmed
Last reviewed
26 July 2026

Found an error?

Send the record URL, the incorrect claim, and a source supporting the correction. “My friend said so” remains unsupported even when your friend types confidently.

Submit a correction →