Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

What it is

The FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting provider. Court documents list its other names as Secury, Massgod, Spamhouse, Lanedo and Omegatech. The provider first appeared on the Exploit cybercrime forum in 2024 but claims to have operated since 2019. In 2025 it claimed the largest collection of autonomous system numbers (ASNs) for malware and botnet hosting.

What the filings and TRM Labs say

Virtualine advertised support for phishing, spam and carding, and offered to move customer services to unaffiliated infrastructure. It also claimed to ignore abuse reports on purpose. It hosted a hack-for-hire customer that stole sexually explicit content from online accounts. After takedown requests from law enforcement in several countries, it helped that customer build a new upload site, and it still hosts that site.

TRM Labs says ransomware groups and an infostealer operator have used Virtualine. It reports that Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof host, despite lower total value than several peers.

Share of payments to its labeled Bitcoin addresses:

StealC infostealer operators also paid Virtualine in 2026.

What to do

The page gives no indicators, IP ranges or ASNs. Defenders can still use the aliases above when searching threat intelligence, abuse logs and ASN reputation data for related infrastructure. The page names no specific mitigation.

Caveats

TRM states that a domain seizure disrupts how customers find and access the service. It does not establish that the operator has stopped, or that customers have lost access to the underlying infrastructure. Blocking only the seized domain therefore gives little protection. The new upload site for the hack-for-hire customer was still hosted by Virtualine when the article was written.