FBI Seizes Domain Of Virtualine Bulletproof Hosting Provider

On October 27, 2026, the FBI seized virtualine.net, the domain of Virtualine, a Russian-speaking bulletproof hosting provider, according to TRM Labs. The FBI Washington Field Office and the US Attorney's Office for the Eastern District of Virginia announced the action, which CybersecurityNews described as court-authorized. TRM says the provider's direct customers included ransomware groups, an infostealer operator and a Russian drug marketplace. Bulletproof hosting providers rent servers and domains while promising to shield customers from abuse complaints and law enforcement. According to court documents cited by SecurityWeek, Virtualine hosted customers' illicit services and helped them evade takedown attempts, and on cybercrime forums it promoted support for phishing, spam and carding and claimed it intentionally ignored abuse. The Justice Department said it also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech, and accepted payments through an option labeled "BTC [NO-AML]" using unhosted Bitcoin addresses. Chainalysis said such addresses let criminal customers avoid hosted-exchange compliance flags. Prosecutors allege Virtualine laundered payments from criminal customers to hide their source. TRM reports that in 2026 Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider, despite receiving less total value than several peers. A Russian drug marketplace accounted for about 44% of direct inflows, a sextortion scheme about 17% (February to June 2026), a mixer about 13% and ransomware groups about 5%. Virtualine also received payments from the StealC infostealer throughout 2026, and Volhav, another bulletproof host, was a direct counterparty. The announcement did not identify individual ransomware groups or disclose total transaction value. Authorities say the operator knowingly hosted a forum promoting child abuse material after warnings that began in January 2026 from police, NCMEC and a victim's attorney. The investigation involved Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the UK National Crime Agency, and private partners OverRIPE and Lumen. Dutch police seized dozens of physical servers in Limburg, taking hundreds of virtual servers offline, and recovered data from more than 3,000 customers, with follow-up action underway. The operator rejected the allegation in an open letter on a new site, virtualine[.]org, according to BleepingComputer. Silent Push reported that Omegatech was not fully offline after the seizure, and TRM cautions that a domain seizure does not by itself show the operator has stopped working or that customers lost all infrastructure access. Readers can lower exposure to this kind of infrastructure by treating services that advertise ignoring abuse complaints, no-AML payment options or unhosted-wallet-only payments as high risk. Businesses should review hosting and network providers for links to such operators and monitor blocklists and threat intelligence for related names and domains. Individuals should not engage with sextortion demands or unsolicited payment requests, and should report abusive content to NCMEC or local police. Enforcement actions may leave related infrastructure reachable, so continued caution is warranted.