FBI Seizes Virtualine Bulletproof Hosting Domain
The FBI seized virtualine.net, a Russian-speaking bulletproof host tied to ransomware and StealC operators. A domain seizure alone does not prove it is offline.
Morgan "airgap" ReyesThe FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting provider. Confirmed by SecurityWeek on October 30, 2026, citing court documents.
Operator status: unconfirmed. SecurityWeek reports the provider continues to host at least one customer site. No source says the operator has stopped working.
What is confirmed
- Court documents name the provider as Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, and Omegatech.
- It hosted customer services and helped them evade law enforcement takedown attempts.
- Forum posts advertised support for phishing, spam, and carding. The provider claimed it intentionally ignored abuse reports.
- It supported at least one customer running a hack-for-hire service aimed at stealing sexually explicit content from online accounts. It kept aiding that customer despite takedown requests from law enforcement in several countries, and helped build a replacement site.
Who used it
Per SecurityWeek’s reporting on analysis by blockchain intelligence firm TRM Labs, ransomware groups and an infostealer operator used Virtualine. In 2026 the provider also received payments from StealC infostealer operators.
TRM’s breakdown of payments to Virtualine’s labeled Bitcoin addresses:
- 44% from a Russian drug marketplace
- 17% from a large sextortion scheme
- 13% from a cryptocurrency mixer
- 5% from ransomware
TRM also says Virtualine received more illicit-attributed cryptocurrency than any other bulletproof host it has labeled.
Timeline
- 2019: Virtualine claims to have operated since this year. Unverified.
- 2024: first appears on the cybercrime forum Exploit.
- 2025: claims the largest collection of autonomous system numbers for malware and botnet hosting. Self-reported.
- October 30, 2026: domain seizure reported.
Limits of the seizure
TRM, as quoted by SecurityWeek: “A domain seizure disrupts how customers find and access a service. It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”
Confidence: high on the seizure and the provider’s role per court documents. Low on operational impact. No source reports what happened to hosted customers or whether the operator has moved.
More in the threat intel hub.
Found this useful? Share it.
