First VPN Service (1vpns[.]com, 1vpns[.]net, 1vpns[.]org) — a criminal anonymization platform serving at least 25 ransomware affiliate groups across a 32-node, 27-country exit network — was seized on May 19-20, 2026 in an 18-nation law enforcement operation. The infrastructure is offline, but affiliated threat actors retain full operational capability and will migrate to alternative platforms. Any historical DNS resolution or connection to these domains in your environment warrants investigation as a potential indicator of ransomware affiliate contact.