On October 27, 2026, the FBI and the U.S. Attorney's Office for the Eastern District of Virginia announced a court-authorized seizure of virtualine.net, the domain of a Russian-speaking bulletproof hosting provider, according to CyberScoop. Prosecutors say the company sold servers and domain registrations to ransomware gangs, infostealer operators and other criminals. The Virtualine FBI seizure is a disruption, not a demolition. The provider denies the allegations, and the Justice Department has not said who runs the service or whether anyone has been arrested.
The FBI worked with German, Dutch and British partners, along with the OverRIPE researcher coalition and Lumen. Chainalysis, which supported the investigation, has published its own tracing of the provider's payments. Most of the money-flow claims in this story come from that tracing, so readers should weigh them as investigators' findings rather than court-tested facts.
What prosecutors say Virtualine did
Prosecutors say the provider also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. It sold hosting, servers and domain registrations to customers it recruited on cybercrime forums. That model is the core of a bulletproof host: it sells the infrastructure criminals need and asks few questions about what runs on it.
The provider tells a different history. It claims to have operated since 2019, according to SecurityWeek, but it first appeared on the Exploit forum in 2024. Hosting providers depend on reputation inside criminal marketplaces, so a newcomer's arrival on a major forum is a meaningful detail.
Which criminal customers the government links to Virtualine
Officials say Virtualine kept hosting a customer that distributed child sexual abuse material and a hack-for-hire service, even after notices from police in several countries and from the National Center for Missing & Exploited Children (NCMEC). The continued hosting after those warnings is central to the case, because it is the clearest example of a provider serving a customer after being told what that customer was doing.
TRM Labs says ransomware groups including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid the operators. Chainalysis says Virtualine's payment addresses link directly to ransomware operators, infostealer infrastructure, Russian-language forums, illicit shops and scam or phishing addresses. Those attributions come from blockchain analysis, so readers should treat them as investigators' conclusions, not admitted facts.
Scale is the other part of the story. Researchers tracking illicit inflows say Virtualine received almost one-fifth of all illicit-attributed inflows they tracked this year. SecurityWeek and Bitdefender report this breakdown of its labeled Bitcoin inflows:
| Labeled Bitcoin inflow source | Share |
|---|---|
| Russian drug marketplace | About 44% |
| Large sextortion scheme | 17% |
| Mixer | 13% |
| Ransomware | 5% |
The ransomware share is the smallest of the four categories. That shifts the picture from a ransomware hosting story to a broader criminal infrastructure story. The largest labeled source was a Russian drug marketplace, and sextortion came second, which is why the practical advice below covers sextortion lures and not only ransomware.
The seizure's logic is captured in one line that TRM's researchers wrote, as quoted by CyberScoop: “A domain seizure disrupts how customers find and access a service.” A bulletproof host depends on customers being able to reach it, and the domain is one of the main paths to that access.
How the Virtualine FBI seizure played out across Europe
The European part of the operation was physical. Dutch police reportedly confiscated dozens of physical servers, taking hundreds of virtual servers offline, according to Bitdefender. Investigators also recovered records on more than 3,000 customers. Those records are the most consequential open thread, because they could lead to charges, and no charges have been announced in the sources reviewed.
The provider responded within hours. It posted an open letter on a second domain, virtualine.org, disputing the allegations and telling Telegram followers their data was safe, according to Help Net Security. That is the company's own statement, and the sources do not independently confirm what happened to its customer data.
Silent Push reported that Omegatech was not fully offline after the seizure, as Cybersecurity News reports. Because Omegatech is one of the names prosecutors listed, the disruption may have reached some aliases more than others.
What bulletproof hosting is and why this case matters
Bulletproof hosting is infrastructure that providers knowingly lease to cybercriminals. A CISA-led advisory uses that framing, according to Brandefense. The label refers to hosts that ignore abuse complaints and takedown requests, which lets malware, phishing kits and command servers stay online longer than they would elsewhere.
Virtualine is part of a wider pattern. Cybersecurity News reports that the U.S. has brought charges against two bulletproof hosting companies, and earlier it sanctioned Aeza, a bulletproof host whose infrastructure supported ransomware and infostealer malware. Washington is increasingly treating hosts, not only malware authors, as targets.
Is Virtualine still online after the seizure
The short answer is that the domain is seized, but no source reviewed says the service is permanently gone. TRM Labs says the operation disrupted Virtualine rather than shutting it down.
Domain seizures have limits. One vendor analysis, cited by Cybersecurity News, says operators have often moved to new infrastructure within days. That claim is not independently verified.
The name “Operation Omegaline” appears in some vendor write-ups, including TechJack Solutions. USA 24 found it only in third-party blogs, not in the Justice Department release, so treat it as unofficial. One blog post also claims that the criminal operators who rented this infrastructure remain active, but that claim is unverified.
What US businesses and users should check now
A TechJack Solutions write-up says organizations whose network history shows connections to Virtualine address space may have communicated with criminal command-and-control infrastructure. The write-up draws on a DOJ and Chainalysis-based analysis.
The steps below are general guidance, not instructions from the FBI or Justice Department:
- Ask your security team or managed security provider to search historical logs for traffic to Virtualine-linked IP ranges. Before blocking anything, check whether official indicators have been published, since the sources reviewed did not include an official list.
- Rotate passwords and session tokens for any system that may have been exposed to infostealers, starting with email, VPN and remote administration accounts.
- Treat sextortion and phishing messages as hostile, especially any that threaten to release private images.
- Enable multifactor authentication on email and banking accounts, and report extortion attempts to local police or the FBI's Internet Crime Complaint Center.
If your team is also tracking ransomware, read how ransomware gangs are exploiting a Palo Alto GlobalProtect flaw, and how ransomware shut schools in the Oneonta City School District.
What to watch next
Three threads will decide how much this case changes the market. The first is whether the Justice Department names the people behind Virtualine or announces charges. The second is what investigators do with the records of more than 3,000 customers. The third is whether the aliases, or the customers who used them, reappear on new infrastructure in the coming weeks.
Watch for any official indicators list or advisory tied to the case, since vendors will keep publishing their own. The most useful next signal is a court filing or Justice Department release that names people, not another blog post.
