The FBI seized the domain virtualine.net on October 27, 2026. Virtualine is a Russian-speaking "bulletproof" hosting provider: it rents servers and promises customers resistance to abuse complaints and law-enforcement requests. According to the US Justice Department, it advertised to criminals, accepted direct Bitcoin payments and laundered customer funds.
What the investigation found
- According to court documents reported by SecurityWeek, Virtualine also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech.
- Despite repeated takedown requests from several countries, it kept hosting a forum that distributed child sexual abuse material and nonconsensual intimate images. The FBI Washington Field Office worked with German, Dutch and British authorities and private-sector partners.
- Blockchain analytics firm TRM Labs published its analysis on October 28, 2026. It attributes about 44% of Virtualine's direct cryptocurrency inflows to a Russian drug marketplace, about 17% to a sextortion scheme, about 13% to a cryptocurrency mixer and about 5% to ransomware groups. TRM also reports payments from StealC infostealer operators in 2026.
What it means for hosting customers
A domain seizure disrupts how customers find and reach a service. It does not show that the operator has stopped or that all of its infrastructure is gone. The Justice Department announced no cryptocurrency seizure amount and no arrests or charges. TRM notes that the provider's known Bitcoin addresses can be used to follow later payments to other hosts.
Crypto payment alone does not make a host a bulletproof host. Providers that accept crypto should still publish clear abuse, DMCA and acceptable-use rules, which we check on each provider's own pages.
Sources