FBI seizes virtualine.net, domain of bulletproof host Virtualine
Original title: Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
TRM Labs ties the host to ransomware and StealC payments and says the seizure may leave infrastructure online.
The FBI seized virtualine.net, the domain of Russian-speaking bulletproof host Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, and Omegate. Court documents say it hosted illicit services, ignored abuse complaints, and helped customers evade takedowns, including by standing up a replacement site. TRM Labs says Virtualine received more illicit-attributed cryptocurrency than any other bulletproof host it labeled, including payments linked to ransomware and the StealC infostealer in 2026.
Unconfirmed: Payment shares and the ranking among bulletproof hosts are TRM Labs figures; the firm says the seizure does not prove the operator stopped.
- Virtualine first appeared on the Exploit forum in 2024 but claims it has operated since 2019.
- TRM says 44 percent of labeled Bitcoin came from a Russian drug marketplace.
- A sextortion scheme accounted for 17 percent, a mixer 13 percent, and ransomware 5 percent.
- The provider still hosts a replacement website created after earlier takedown requests.
- Malware
- StealC
- Organizations
- FBITRM LabsVirtualine
- Countries
- United States
From the original article
2 min read at securityweek.com
It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments. The post Bulletproof Host Virtualine Loses Its Domain to FBI Seizure appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.