FBI seizes Virtualine bulletproof hosting domain in international cybercrime operation
The US Justice Department seized the domain of Virtualine, a bulletproof hosting service that Chainalysis links to ransomware operators and infostealer infrastructure, in a coordinated takedown.
At a glance
- The DOJ announced seizure of the virtualine[.]net domain, which now shows an FBI notice, as part of a coordinated international operation.
- Virtualine is described as a bulletproof hosting provider that advertised to criminals and also operated under names including Secury, Massgod and Omegatech.
- Chainalysis says its on-chain activity links Virtualine to ransomware operators, infostealer infrastructure, and Russian-language cybercrime forums.
- The FBI worked with police in Germany and the Netherlands, the UK's National Crime Agency, OverRIPE and Lumen Technologies.
The U.S. Department of Justice has seized the domain of Virtualine, a so-called bulletproof hosting (BPH) provider that security researchers tie to ransomware and other cybercrime, The Hacker News and BleepingComputer reported on October 28, 2026. According to the DOJ, visitors to virtualine[.]net now see a seizure notice from the FBI, posted as part of a coordinated international operation.
What happened
The Hacker News reports that the DOJ announced the seizure on Tuesday and described Virtualine as a hosting service that tolerated or enabled criminal activity. Court documents say it also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech, and advertised to criminals on cybercrime forums, offering its services for activities such as phishing, carding, email spam and port scanning. In a June 2025 post on HackForums, the operation allegedly boasted that "Virtualine ignored more abuse than your last three therapists." The FBI carried out the action alongside Germany's Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, the internet registry group OverRIPE and Lumen Technologies.
Technical details
The DOJ alleges Virtualine accepted payment in Bitcoin through unhosted addresses labeled "BTC [NO-AML]," which it says let customers pay without their funds being flagged as illicit, and that some funds traced to criminal groups were then laundered to hide their origin. The Hacker News cites Chainalysis, which reported that Virtualine's on-chain activity links it to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses. The DOJ also says the service knowingly hosted illegal content, including child sexual abuse material and nonconsensual imagery, despite repeated notices from law enforcement in several countries. The operator, who is not named in the reporting, published an open letter denying it knowingly hosted such material and said on Telegram that customer data was safe.
Who is affected
Archived pricing pages showed plans ranging from about $19.99 to $379.99 per month, The Hacker News reports. The takedown fits a broader pattern of pressure on bulletproof hosts: in September 2025, the Spamhaus Project reported that Virtualine had expanded to the autonomous system AS209800 using Turkey- and U.S.-based IP brokers with weak vetting, routed through aurologic GmbH. Silent Push cautioned that losing an ASN does not stop a BPH operation, since acquiring a new one is fast, and argued for stricter ASN registration — a reminder that domain seizures disrupt, but rarely end, resilient criminal infrastructure.
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
