- The FBI seized Virtualine’s virtualine.net domain on Oct 27, with partners in Germany, the Netherlands and the UK named in the announcement.
- Virtualine received more illicit-attributed cryptocurrency in 2026 than any other TRM-labeled bulletproof hosting provider.
- The domain seizure disrupts access but does not establish that Virtualine stopped operating or that all underlying infrastructure became inaccessible.
The FBI seized Virtualine’s virtualine.net domain on Oct 27 in an international law-enforcement operation, the FBI Washington Field Office and the U.S. Attorney’s Office for the Eastern District of Virginia announced. Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the UK National Crime Agency were named as partners.
TRM Labs said Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider in 2026. A Russian drug marketplace accounted for about 44% of its direct inflows, while a large sextortion scheme accounted for about 17% and ransomware groups accounted for about 5%.
The seizure disrupts how customers find and access the service, but does not establish that Virtualine stopped operating or that all underlying infrastructure became inaccessible. TRM Labs published its report on Oct 28.
On this page
Virtualine’s inflows linked it to drug markets, sextortion and ransomware
A Russian drug marketplace accounted for about 44% of Virtualine’s direct inflows. A mixer accounted for about 13%, and a large sextortion scheme sent funds to the service between February and June 2026.
Virtualine also received payments from the StealC infostealer throughout 2026. TRM Labs identified Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin among ransomware groups that paid the site’s operators.
Virtualine advertised bulletproof servers from USD 0.79 per month
TRM Labs said Virtualine advertised “off-shore web hosting, bulletproof cloud servers, bulletproof domains, and dedicated machines,” with prices starting at USD 0.79 per month. It joined the Exploit cybercrime forum on Aug 28, 2024, and claimed to have operated since 2019.
Authorities linked Virtualine to continued hosting after notices
Officials said Virtualine continued hosting services for a customer that distributed child sexual abuse material and a hack-for-hire service after it received numerous notices from law enforcement.
SecurityWeek also said Virtualine advertised moving customer services to unaffiliated infrastructure and claimed it intentionally ignored abuse.
TRM Labs said blockchain records remain available after a domain seizure and can show payment relationships and subsequent destinations.
The seizure followed a court order obtained by the FBI and prosecutors, according to CyberScoop. The available information does not establish whether Virtualine stopped operating or whether customers lost access to all of its underlying infrastructure.
FAQ
What happened to Virtualine?
The FBI seized Virtualine’s virtualine.net domain on Oct 27 in an international law-enforcement operation. The seizure disrupts customer access, but does not establish that the operator stopped working.
Who used Virtualine?
TRM Labs identified payments from a Russian drug marketplace, a sextortion scheme, a mixer, the StealC infostealer and ransomware groups including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin.
Was Virtualine exploited or confirmed to have stopped operating?
The domain seizure was confirmed, but TRM Labs said it does not establish that Virtualine stopped operating or that customers lost access to all underlying infrastructure.
What did Virtualine provide?
TRM Labs said Virtualine advertised offshore web hosting, bulletproof cloud servers, bulletproof domains and dedicated machines, with prices starting at USD 0.79 per month.
When did Virtualine join the Exploit forum?
TRM Labs said Virtualine joined the Exploit cybercrime forum on Aug 28, 2024, and claimed to have operated since 2019.
Sources
- FBI Seizes Virtualine Domain After Provider Led Bulletproof Hosting Sector in Illicit Inflows | TRM Labs, TRM LabsPrimary
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure, SecurityWeek
- FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police, Help Net Security
- Police seize Virtualine bulletproof service tied to ransowmare, cybercrime, BleepingComputer
- Officials seize domain of top bulletproof hosting provider Virtualine, CyberScoop
How we checked this story
| Claim | Source | Status |
|---|---|---|
| SecurityWeek said the FBI seized virtualine.net, the domain of a Russian-speaking bulletproof hosting provider associated with cybercriminal operations. | SecurityWeek | Attributed |
| SecurityWeek said virtualine was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech. | SecurityWeek | Attributed |
| SecurityWeek said virtualine advertised moving customer services to unaffiliated infrastructure and claimed it intentionally ignored abuse. | SecurityWeek | Attributed |
| SecurityWeek said virtualine hosted a forum where users could post and sell explicit images and videos of minors and adults. | SecurityWeek | Attributed |
| TRM Labs said Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider in 2026. | TRM Labs | Confirmed |
| A Russian drug marketplace accounted for about 44% of Virtualine’s direct inflows, while ransomware groups accounted for about 5%. | TRM Labs | Confirmed |
| A large sextortion scheme accounted for about 17% of Virtualine’s direct inflows, with transfers sent between February and June 2026. | TRM Labs | Confirmed |
| A mixer accounted for about 13% of Virtualine’s direct inflows. | TRM Labs | Confirmed |
| Virtualine received payments from the StealC infostealer throughout 2026. | TRM Labs | Confirmed |
| TRM Labs said Virtualine joined the Exploit cybercrime forum on 28 August 2024 and claimed to have operated since 2019. | TRM Labs | Confirmed |
| Virtualine advertised offshore hosting, bulletproof cloud servers, bulletproof domains and dedicated machines starting at USD 0.79 per month. | TRM Labs | Confirmed |
| The FBI Washington Field Office and the U.S. Attorney’s Office for the Eastern District of Virginia announced the seizure on 27 October 2026. | TRM Labs | Confirmed |
| Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the UK National Crime Agency were named as partners. | TRM Labs | Confirmed |
| TRM Labs said the domain seizure disrupts customer access but does not establish that Virtualine stopped operating or that all underlying infrastructure became inaccessible. | TRM Labs | Confirmed |
| Help Net Security reported that Virtualine laundered money for criminals and maintained a forum selling child sexual abuse material. | Help Net Security | Attributed |
| BleepingComputer reported that U.S. law enforcement seized Virtualine’s primary domain. | BleepingComputer | Attributed |
| CyberScoop reported that Virtualine received the most illicit-attributed value in 2026 among bulletproof hosting providers tracked by TRM Labs. | CyberScoop | Attributed |
| Ari Redbord of TRM Labs said Virtualine exemplified Russia’s illicit economy connecting darknet markets, ransomware groups, exchanges and brokers. | Ari Redbord, via CyberScoop | Attributed |
| TRM Labs said blockchain records remain after a domain seizure and can show payment relationships and subsequent destinations. | TRM Labs, via CyberScoop | Attributed |
| TRM Labs identified Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin among ransomware groups that paid Virtualine. | TRM Labs, via CyberScoop | Attributed |
| CyberScoop said the FBI and prosecutors obtained a court order to seize Virtualine’s primary domain. | CyberScoop | Attributed |
| Officials said Virtualine continued hosting a customer distributing child sexual abuse material and a hack-for-hire service after receiving numerous notices. | Officials, via CyberScoop | Attributed |
| trmlabs.com published its report on Oct 28, 2026. | trmlabs.com | Confirmed |
Could not verify
- Whether Virtualine’s operators were arrested or charged is not established
- Whether the seizure ended Virtualine’s operations or removed its underlying infrastructure is not established
- How many customers or criminal services were affected is not established
- Whether Virtualine directly hosted the reported attacks or services is not established
Related stories
Vulns & PatchesCisco Catalyst SD-WAN flaw exploited to deploy KeyDrift malware
Vulns & PatchesLinux kernel flaw could let remote attackers run commands as root
Vulns & PatchesRuby releases Onigmo fixes for GitLab remote-code-execution flaws