FBI seizes domain of bulletproof host Virtualine

The FBI has seized virtualine.net, the domain of Virtualine, a Russian-speaking bulletproof hosting provider, SecurityWeek reported on 30 October 2026. According to court documents cited in the article, Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, hosted customers' illicit services and helped them evade takedown attempts.

On cybercrime forums it promoted support for phishing, spam and carding, offered to move customer services to unaffiliated infrastructure and claimed it deliberately ignored abuse reports. It also allowed users to post and sell explicit images and videos of minors and adults, and kept hosting a hack-for-hire customer despite takedown requests from law enforcement in several countries. Virtualine first appeared on the Exploit forum in 2024 but claims to have operated since 2019.

TRM Labs says Virtualine received more illicit-attributed cryptocurrency than any other bulletproof host it tracks. Most payments to its labeled Bitcoin addresses came from a Russian drug marketplace (44%) and a large sextortion scheme (17%), followed by a mixer (13%) and ransomware (5%); StealC infostealer operators also paid it in 2026.

Why it matters Bulletproof hosts are shared infrastructure for many criminal trades at once, so their payment flows map who works with whom. As TRM Labs notes, a domain seizure disrupts how customers find a service but does not show that the operator has stopped, so the infrastructure is worth watching after the seizure.