The most notorious player in cybercrime has suddenly vanished from the web, sparking fears that the Russian-based organisation has gone to ground and is set to re-emerge as an even greater threat from a new base in China.

The shadowy Russian Business Network (RBN), which operates from St Petersburg, has been linked to a vast range of illegal activities spanning child pornography, blackmail, spamming, identity theft and piracy.

Such has been the scale of its operations, RBN is widely recognised as the most brazen player in a global cybercrime scene estimated by the US Treasury to be worth more than the global illegal drugs trade – more than $100 billion a year.

Analysts for Spamhaus, the internet security company, said: “It is tough to find a serious cyber-crime attack over the past two to three years that did not involve RBN internet addresses to some degree.”

Dubbed “the mother of all cybercrime” by analysts, RBN specialises in providing services such as “bulletproof” website hosting to criminal groups. These sites, for which RBN charges around $600 a year, are largely used to publish illegal content and carry out scams on the public. Run through a complex network of front companies based in territories from Belize to Hong Kong, they are designed to thwart law authorities, according to security experts.

The group has also been linked to the Russian authorities and is also thought likely by some analysts to have played a role in international cyber attacks including the recent assault on Estonian cyberspace.

A recent report from Symantec, the online security firm, said: "It is alleged that this organised cyber crime syndicate has strong links with the Russian criminal underground as well as the government, probably accomplished by bribing officials."

However, in recent days huge swathes of RBN-hosted sites have effectively disappeared from the web leading analysts to suggest that the group, thought to be massively profitable, is revamping its business model and activities.

“The speculation must be that RBN is reorganising,” said Raimund Genes, the chief technology officer of Trend Micro, a security group that has traced cyber attacks on corporate and government sites across Europe and US back to servers based in Panama and run by RBN.

Trend Micro analysts have suggested that RBN is probably diversifying its operations after its operations became a subject of online chatter, leading the Russian group to be cut off by legitimate internet server providers including Tiscali.co.uk, which had previously sold it “upstream” internet capacity.

At the same time, analysts have reported unusual bulk registries of thousands of internet web addresses in China and other Asian territories, which they say fit the past behaviour of RBN. Experts have given warning that China could provide RBN with an even broader base to support criminal activities, a move that Trend Micro believes could herald a fresh surge of cybercrime.

But security analysts admit that much of their work on tracking down the figures behind RBN strays into guesswork. The group is run by a figure only known by the online pseudonym "Flyman", thought to be related to a St Petersburg politician. It is believed that serious investigations by Western authorities have been successfully stymied by corrupt officials.

Calls by The Times to contact numbers linked to RBN by security firms did not get replies.

A report from VeriSign, a security group, said: "RBN ... pay a huge amount of people. They know they are being watched. They cover their tracks."

Times Recommends

• Lies and cover-up at MG Rover exposed by report
• High oil prices push manufacturing costs up
• Primark founder steps down as chief executive