FBI Seizes Virtualine Bulletproof Hosting Domain Linked to Ransomware and Cybercrime

The FBI seized virtualine.net, the main website of a bulletproof hosting provider linked to ransomware operators, stolen-data markets, and other cybercrime services.

Announced on October 27, 2026, the court-authorized action targeted a business accused of helping criminals keep their websites online, ignore abuse complaints, and hide payments.

The U.S. Justice Department said Virtualine also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech. It sold hosting, servers, and domain registration services while openly seeking customers on cybercrime forums.

Investigators linked its services to child sexual abuse material, the sharing of intimate images without consent, and international money laundering.s

Virtualine marketed its willingness to support illegal activity as a selling point. In September 2024, it told an Exploit. user that customers could use its services for phishing, payment card fraud, spam, port scanning, and other illegal activities. Its stated exceptions were child abuse content and terrorism.

By March 2026, the provider was advertising an “additional protection plan” for customers facing law enforcement requests. Under that plan, Virtualine would move a customer’s criminal infrastructure to an unrelated shell company and reactivate the server, according to court records cited by prosecutors.

FBI Seizes Virtualine Bulletproof Hosting

That offer shows how bulletproof hosting can help criminal operations recover from pressure rather than provide server space. Similar concerns appeared in earlier coverage of U.S. sanctions against bulletproof hosting provider Aeza, whose infrastructure supported ransomware and information-stealing malware.

Chainalysis reported that Virtualine’s payment addresses were directly linked to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses. These findings provide context for the hosting provider’s role in several types of online crime.

The Justice Department said Virtualine accepted payments through an option labeled “BTC [NO-AML],” using unhosted Bitcoin addresses. Prosecutors allege that Virtualine then laundered payments from criminal customers to hide their source. The announcement did not identify individual ransomware groups or disclose the total value of those transactions.

A central part of the investigation involved a criminal forum identified as Vendor 1. Prosecutors say it sold access to explicit images of minors and adults and promoted hackers who could break into victims’ accounts to steal private material.

Virtualine began receiving warnings about child sexual abuse material in January 2026. Notices came from police in Germany, Canada, and Australia, the National Center for Missing and Exploited Children, and a victim’s attorney. Despite those reports, Virtualine allegedly kept the forum online and helped build another site to upload and sell content.

The FBI Washington Field Office led the investigation with German, Dutch, and British authorities, alongside OverRIPE and Lumen. The case follows wider action against criminal hosting, including U.S. charges against two bulletproof hosting companies.

However, taking control of Virtualine’s domain does not establish that every related server stopped operating. Silent Push reported that Omegatech was not fully offline after the seizure.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post FBI Seizes Virtualine Bulletproof Hosting Domain Linked to Ransomware and Cybercrime appeared first on Cyber Security News.