FBI Seizes Virtualine Domain Linked to Cybercrime Operations

The FBI has seized the domain virtualine[.]net, the workspace of a Russian-speaking bulletproof hosting provider linked to a range of cybercriminal operations. SecurityWeek notes the entity, known also as Secury, Massgod, Spamhouse, Lanedo and Omegatech, hosted illicit services for customers and helped them dodge enforcement takedowns. On cybercrime forums, Virtualine advertised support for phishing, spam and carding, promoted moving services to unaffiliated infrastructure, and claimed to ignore abuse.

It also allowed posting and sale of explicit images and videos, and backed at least one client that offered a hack-for-hire service to steal sexually explicit content from online accounts; the provider reportedly helped the client create a new site and continues to host the new infrastructure.

TRM Labs, a blockchain intelligence firm, says Virtualine has facilitated substantial illicit inflows, noting that, among bulletproof hosts labeled by TRM, Virtualine “received more illicit-attributed cryptocurrency than any other” despite lower total value than some peers. The firm adds that a domain seizure disrupts access but does not by itself prove the operator stopped or that all underlying infrastructure is inaccessible.

The article also traces Virtualine’s activity across ransomware groups and an infostealer operator, with 2025 claims of the largest autonomous system number collection for malware and botnet hosting, and 44% of labeled payments coming from a Russian drug marketplace, 17% from a large sextortion scheme, 13% from a cryptocurrency mixer, 5% from ransomware, and in 2026 payments from StealC infostealer operators.