The original text is in EN, taken from the source site. Source ↗

Cybercrime

Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.

By

Ionut Arghire

| October 30, 2026 (9:36 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

The FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting services provider associated with various cybercriminal operations.

According to court documents, Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, has been hosting customers’ illicit services and helped them evade law enforcement takedown attempts.

In posts on cybercrime forums, Virtualine promoted support for various types of cybercriminal activity, including phishing, spam, carding, and more; advertised its ability to move customer services to unaffiliated infrastructure; and claimed it intentionally ignored abuse.

It also allowed users to post and sell explicit images and videos of minors and adults, and supported at least one customer that offered a hack-for-hire service aimed at stealing sexually explicit content from online accounts.

Despite receiving numerous takedown requests from law enforcement agencies in several countries, Virtualine continued to aid the customer and even helped them create a new website for uploading the illicit content. The provider continues to host the new website.

According to blockchain intelligence firm TRM Labs, Virtualine has been used, among others, by ransomware groups and an infostealer operator.

Advertisement. Scroll to continue reading.

“Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider, despite receiving less total value than several peers,” the company says.

The bulletproof hosting provider first emerged on the cybercrime forum Exploit in 2024, but claims to have been operating since 2019. It claimed to have had the largest collection of autonomous system numbers for malware and botnet hosting in 2025.

Most of the payments Virtualine’s labeled Bitcoin addresses have received came from a Russian drug marketplace (44%) and a large sextortion scheme (17%). A cryptocurrency mixer accounted for 13% of them and ransomware for 5%. In 2026, Virtualine also received payments from the StealC infostealer operators.

“A domain seizure disrupts how customers find and access a service. It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure,” TRM notes.

Related:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Related:Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Related:Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Related:Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
  • Over 41,000 DHS Employee Records Leaked Online
  • HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
  • Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  • Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
  • Chrome and Firefox Updates Patch Over 200 Vulnerabilities
  • China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  • Hackers Start Probing Fresh Oracle EBS Vulnerability

Latest News

  • Fresh WordPress Vulnerability in Attackers’ Crosshairs
  • Drupal Commerce Core Vulnerability Exploited Against Online Stores
  • $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
  • Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
  • TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
  • $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  • When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
  • Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model

Trending

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Hackers Start Probing Fresh Oracle EBS Vulnerability

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Quantum eMotion has named Wayne Teeple as CTO.

Guy Ellis has been appointed CEO of NCC Group.

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)