NetWalker

rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion · 1 additional domains

Observed: 27 January 2021

What is this?

Two NetWalker onion addresses are associated with an archived seizure page dated 27 January 2021. The U.S. Department of Justice stated that Bulgarian authorities seized a hidden resource used to provide payment instructions and communicate with victims and that visitors would see a law-enforcement seizure banner.

Operation: Not confirmed
Agency: Federal Bureau of Investigation, Bulgarian National Investigation Service, Bulgarian General Directorate Combating Organized Crime
Category: ransomware
Action: international infrastructure seizure

Before and after

BEFORE is shown only when a separately sourced public capture exists strictly before the seizure date. AFTER is the content-addressed upstream seizure-banner object.

Associated domains

These are archival labels, not live links. A seized, expired, or reassigned domain is a poor place to send readers without warning.

rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

seized.fyi states that its domain lists are not always complete. Count: 2.

Why was it seized?

Read the reviewed case timeline →

Preserved artifact

OpenSpy object: Open preserved original
Upstream record: seized.fyi
Observed: 2021-01-27
Media: image/jpeg
Resolution: 1147×800
Bytes: 286,054
SHA-256: 608a34ca006af68692397a62b64ef072f8a9414285c5084f7363e060ab37b0bd
Upstream filename: 608a34ca006af68692397a62b64ef072.jpg

Reviewed case sources

Department of Justice Launches Global Action Against NetWalker Ransomware U.S. Department of Justice · official law-enforcement announcement
NetWalker website seizure banner Extortion Wiki · verified archive record