The FBI has seized virtualine.net, the primary domain of Virtualine, a Russian-speaking “bulletproof” hosting provider accused of enabling cybercrime ranging from child sexual abuse material and sextortion to ransomware, data theft and money laundering. The U.S. Justice Department said the court-authorized seizure took place on Oct. 27 as part of an international operation involving the FBI, German and Dutch police, the U.K. National Crime Agency, OverRIPE and Lumen. The Justice Department’s announcement identifies the service as also operating under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech.
According to court records cited by prosecutors, Virtualine continued hosting an online forum that advertised and sold sexually explicit images of minors and adults, while also promoting a hack-for-hire service targeting victims’ accounts. Authorities said the provider received repeated abuse reports from law-enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children and a victim’s attorney. Despite those notifications, Virtualine allegedly helped the forum create replacement infrastructure for uploading and distributing illicit content.
Prosecutors also allege that Virtualine marketed hosting to cybercriminals and offered an “additional protection plan” designed to evade law-enforcement action. Under the plan, customers’ infrastructure could be moved to another shell company after an official request, allowing the server to be reactivated. The provider accepted bitcoin through addresses described in court records as having no anti-money-laundering controls, and investigators said some customer payments could be traced to criminal groups before being further laundered.
Blockchain intelligence company TRM Labs said Virtualine received the largest share of illicit-attributed cryptocurrency inflows among the bulletproof hosting providers it tracked in 2026, accounting for almost one-fifth of the sector’s total. A Russian drug marketplace represented nearly 44% of direct payments to the service, followed by a sextortion operation at nearly 17%, a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%. TRM Labs reported that customers or counterparties included ransomware operations such as Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin, as well as the StealC infostealer and Matanbuchu loader.
The seizure disrupts Virtualine’s public-facing access point but does not establish that its operators or customers have stopped working. TRM warned that taking a domain offline can prevent customers from finding or reaching a service without removing the underlying servers, alternate domains or criminal infrastructure. Defenders should therefore treat the operation as an opportunity to review indicators tied to Virtualine and its aliases, investigate connections to affected infrastructure and preserve relevant cryptocurrency and network telemetry. The Justice Department said the investigation was assisted by its Office of International Affairs and the FBI Washington Field Office.
