The FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting services provider associated with various cybercriminal operations.
According to court documents, Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, has been hosting customers’ illicit services and helped them evade law enforcement takedown attempts.
In posts on cybercrime forums, Virtualine promoted support for various types of cybercriminal activity, including phishing, spam, carding, and more; advertised its ability to move customer services to unaffiliated infrastructure; and claimed it intentionally ignored abuse.
It also allowed users to post and sell explicit images and videos of minors and adults, and supported at least one customer that offered a hack-for-hire service aimed at stealing sexually explicit content from online accounts.
Despite receiving numerous takedown requests from law enforcement agencies in several countries, Virtualine continued to aid the customer and even helped them create a new website for uploading the illicit content. The provider continues to host the new website.
According to blockchain intelligence firm TRM Labs, Virtualine has been used, among others, by ransomware groups and an infostealer operator.
“Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider, despite receiving less total value than several peers,” the company says.
The bulletproof hosting provider first emerged on the cybercrime forum Exploit in 2024, but claims to have been operating since 2019. It claimed to have had the largest collection of autonomous system numbers for malware and botnet hosting in 2025.
Most of the payments Virtualine’s labeled Bitcoin addresses have received came from a Russian drug marketplace (44%) and a large sextortion scheme (17%). A cryptocurrency mixer accounted for 13% of them and ransomware for 5%. In 2026, Virtualine also received payments from the StealC infostealer operators.
“A domain seizure disrupts how customers find and access a service. It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure,” TRM notes.
Related: Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Related: Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Related: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Related: Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
