Cybersecurity

FBI Seizes Domain of Russian Bulletproof Host Virtualine

The FBI has seized the virtualine.net domain, targeting a Russian-speaking bulletproof hosting provider that facilitated widespread cybercriminal operations.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 3 min read

FBI Seizes Domain of Russian Bulletproof Host Virtualine — Image: SecurityWeek

FBI Seizes Virtualine Domain

The Federal Bureau of Investigation has seized virtualine.net, the domain used by a Russian-speaking bulletproof hosting services provider linked to a wide array of cybercriminal operations. According to court documents, the provider—which is also known under aliases such as Secury, Massgod, Spamhouse, Lanedo, and Omegatech—has routinely hosted illicit customer services and actively helped malicious actors evade law enforcement takedown attempts. Further details are available from SecurityWeek in the original source material.

In promotional posts across various cybercrime forums, the hosting provider explicitly advertised its support for numerous forms of cybercrime, including phishing, spam campaigns, and carding. Furthermore, the entity touted its technical capability to transition customer operations onto unaffiliated infrastructure while maintaining a policy of intentionally ignoring abuse complaints. Further details are available from says in the original source material.

Facilitating Ransomware, Infostealers, and Illicit Content

Beyond financial cybercrimes, the hosting provider accommodated the distribution of explicit images and videos involving both minors and adults. Court records highlight that Virtualine supported at least one customer offering a hack-for-hire service designed to steal sexually explicit content from online accounts. Despite facing multiple takedown requests issued by international law enforcement agencies, the provider continued to support this customer and even assisted in establishing a new website to host the illicit content, which remains active.

According to insights from blockchain intelligence firm TRM Labs, the bulletproof infrastructure has been leveraged by multiple ransomware groups and infostealer operators. TRM Labs [says](https://www.trmlabs.com/resources/blog/fbi-seizes-virtualine-domain-after-provider-led-bulletproof-hosting-sector-in-illicit-inflows) that Virtualine accumulated more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider, despite taking in a lower total transaction value than several of its industry peers.

Origins and Cryptocurrency Flows

The hosting entity first surfaced on the Exploit cybercrime forum in 2024, though it has claimed active operations stretching back to 2019. By 2025, the provider boasted of holding the largest collection of autonomous system numbers dedicated to hosting malware and botnets. Financial tracking of labeled Bitcoin addresses associated with the service reveals that the vast majority of funds originated from a Russian drug marketplace, accounting for 44 percent of receipts, alongside a major sextortion scheme contributing 17 percent.

Additional fund movements included 13 percent routed through cryptocurrency mixers and 5 percent directly tied to ransomware operations. By 2026, the provider was also receiving payments originating from the operators of the StealC infostealer.

Impact of the Domain Seizure

While federal law enforcement has successfully taken control of the primary domain, cybersecurity analysts emphasize that domain seizures represent only a partial disruption. TRM Labs observes that a domain seizure primarily disrupts the mechanisms by which customers locate and access a service. However, such an action does not inherently prove that the underlying operators have ceased operations or that customers have been entirely cut off from supporting infrastructure.

As law enforcement agencies globally continue to crack down on cybercrime ecosystems, related enforcement actions remain ongoing across the sector, including recent measures such as those detailed by [SecurityWeek](https://www.securityweek.com/bulletproof-host-virtualine-loses-its-domain-fbi-seizure/).