FBI seizes Virtualine domain; replacement hosting still online
October 30: SecurityWeek says Virtualine is Russian-speaking, first appeared on Exploit in 2024 while claiming operations since 2019, and TRM ranks its labeled illicit cryptocurrency highest among tracked bulletproof hosts.
The FBI seized virtualine.net on October 27; no charges are filed, and a replacement site remains online.
On October 27, 2026, a court authorized the FBI to seize virtualine.net, the main domain of bulletproof host Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Prosecutors say it advertised phishing, carding, spam and port scanning, kept a forum selling sexual images of minors online after January 2026 notices, and accepted unhosted bitcoin through “BTC [NO-AML].” Dutch police took hundreds of virtual servers offline in Limburg and recovered data on more than 3,000 customers; German and UK agencies, OverRIPE and Lumen assisted. No operators were named and no charges were announced. The government says Virtualine still hosts a replacement site that has drawn a child-abuse complaint; researchers say parts of the network remain reachable, and the operator denies the claims.
- Seizure of virtualine.net was court-authorized on October 27, 2026; no charges announced.
- TRM says a Russian drug market was about 44% of labeled Bitcoin payments and ransomware about 5%.
- TRM also attributes nearly 17% to a sextortion scheme and almost 13% to a mixer.
- Named paying ransomware groups include Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin.
- Dutch police recovered data on more than 3,000 customers after taking virtual servers offline.
- Virtualine claims it has operated since 2019; it first appeared on Exploit in 2024.
Timeline
dated events in the reporting · oldest first- Feb 11, 2026Silent Push tracked a shift from Railnet to Omegatech. · Help Net Security
- Oct 27, 2026FBI seized virtualine.net in a court-authorized action. · Cyber Security News
What each outlet adds
beyond the shared facts- BleepingComputerDutch police seized Limburg servers and recovered data on over 3,000 customers.
- CyberScoopTRM payment shares and named ransomware groups including Qilin and DragonForce.
- The RecordNo operators named or charges announced; bitcoin service called BTC [NO-AML].
- SecurityWeekCalls Virtualine Russian-speaking and notes its 2019 operating claim.
- Security AffairsGovernment says the replacement site has already drawn a child-abuse complaint.
Coverage
oldest first · one row per article · UTC- · 2d ago
The Hacker NewsFirst report
FBI seizes Virtualine domain over alleged criminal hosting
Prosecutors say the host kept a forum online after child-exploitation notices and took unhosted bitcoin.
- · 2d ago
Help Net Security
FBI seizes Virtualine bulletproof hosting domain in Operation Omegaline
German, Dutch and UK agencies assisted; the operator said it could rebrand and resume within about a day.
- · 2d ago
The Record
FBI seizes Virtualine bulletproof hosting domain
A court authorized seizure of virtualine.net; prosecutors allege it kept serving a forum after child-abuse complaints and have not charged operators.
- · 2d ago
Cyber Security News
FBI seizes Virtualine bulletproof hosting domain
Prosecutors say the host ignored abuse notices, offered to move infrastructure after law-enforcement requests, and took unhosted Bitcoin payments.
- · 2d ago
BleepingComputer
US and partners seize Virtualine bulletproof hosting domain
Dutch police seized dozens of servers in Limburg and recovered data on more than 3,000 customers; follow-up is underway.
- · 1d ago
CyberScoop
US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
- · 1d ago
Security Affairs
FBI seizes Virtualine.net over alleged criminal hosting
The government says Virtualine still hosts a replacement site that has already drawn a child-abuse complaint.
- · 9h ago
SecurityWeek
FBI seizes virtualine.net, domain of bulletproof host Virtualine
TRM Labs ties the host to ransomware and StealC payments and says the seizure may leave infrastructure online.