Officials seize domain of top bulletproof hosting provider Virtualine

Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

“Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

“Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

Latest Podcasts

Government

• National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals

• CISA publishes strategy with eye on the next four years

• Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber

• Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers

Technology

• All the security risks Anthropic is worried about before its IPO 

• Senators say targeted ads are a security risk. Ad groups say the critics are off base.

• eMudhra kills its certificate business after researchers cracked its private keys in under a second

• Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic

Threats

• Experts temper emergency-level alarms over critical Brotli defect

• Authorities extradite Chinese national for alleged $37M investment scam

• Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

• PHP releases emergency fixes for 2 critical vulnerabilities

Policy

• DOJ escalates fight for election supremacy with California raids

• DHS to ban DeepSeek from federal civilian agencies

• Federal agencies recommend cyber controls, independent testing for frontier AI systems

• The next election influence campaign will target your AI chatbot