The FBI has seized the main website of Virtualine, a Russian-speaking bulletproof hosting provider accused of supporting cybercrime operations, in an international law enforcement action involving authorities in the United States, Germany, the Netherlands and the United Kingdom.
The operation went beyond taking control of a domain. Dutch police separately confirmed that they had seized dozens of physical servers at a data centre in Limburg, taking hundreds of virtual servers offline and obtaining information relating to more than 3,000 customers who used the infrastructure for criminal activities.
The action is intended to disrupt hosting infrastructure linked to ransomware, phishing, infostealer malware and other illegal online services. Investigators are now examining the seized data for further action against customers.
FBI Seizes Virtualine’s Main Domain
The US Department of Justice announced on October 27 that the FBI had obtained court authorisation to seize virtualine.net, the main website of Virtualine.
According to court records, the provider also operated under names including Secury, Massgod, Spamhouse, Lanedo and Omegatech. It offered web hosting, servers and domain registration services while advertising its willingness to ignore abuse complaints and law enforcement requests.
Virtualine allegedly promoted its services on cybercrime forums, including for phishing, carding, email spam and port scanning. In March 2026, it advertised a protection arrangement under which customers facing law enforcement requests could have their criminal infrastructure moved to another company before their servers were reactivated.
The FBI operation received support from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the UK’s National Crime Agency, along with private-sector partners OverRIPE and Lumen.
Dutch Police Seize Dozens Of Servers And Customer Records
The Dutch police operation targeted physical infrastructure in the province of Limburg. Authorities said dozens of servers were seized from a data centre, causing hundreds of virtual servers to go offline.
Investigators also obtained data relating to more than 3,000 customers who had used the servers for criminal activities. Police said they were pursuing follow-up action against these users.
The investigation linked the hosting company to activities dating back to 2022, including ransomware attacks, botnets, infostealer malware, phishing and the distribution of child sexual abuse material.
The seized records could help investigators identify customers, trace their infrastructure and examine possible links between different criminal operations. However, the possession of customer records does not mean every person or organisation listed has been convicted of an offence.
Court Records Detail Alleged Support For Illegal Websites
The US Justice Department alleges that Virtualine continued hosting a criminal online forum even after receiving multiple warnings from law enforcement agencies and other organisations.
According to court records, the forum allowed users to post and sell access to sexually explicit images and videos involving minors and adults. It also promoted a hack-for-hire service through which customers could pay hackers to break into online accounts and steal intimate material.
Authorities in Germany, Canada and Australia, along with the US National Center for Missing and Exploited Children and a victim’s attorney, reportedly sent notices about the content.
Prosecutors allege that Virtualine continued providing hosting services and helped the forum operators create another website to upload and distribute the material.
The provider also accepted direct Bitcoin payments through unhosted wallet addresses. The Justice Department alleges that funds received from criminal customers were subsequently moved to conceal their origins.
Blockchain Analysis Links Provider To Ransomware And Illicit Markets
Blockchain intelligence firm TRM Labs found that Virtualine received more cryptocurrency linked to illicit activity in 2026 than any other bulletproof hosting provider labelled by the company, even though some competing providers received higher total inflows.
Its analysis of Virtualine’s direct cryptocurrency receipts showed that a Russian drug marketplace accounted for approximately 44% of inflows. A large sextortion scheme accounted for about 17%, a cryptocurrency mixer for 13% and ransomware groups for around 5%.
TRM also identified payments associated with the StealC infostealer and other cybercrime infrastructure.
These figures describe financial relationships identified through blockchain analysis. They do not establish that every transaction funded a particular cyberattack or that every customer was directly involved in criminal activity.
What Is Bulletproof Hosting?
Bulletproof hosting refers to web and server providers that deliberately ignore abuse complaints and attempt to shield customers from law enforcement action.
Legitimate hosting companies generally investigate reports of malware, phishing or illegal content and may suspend services when violations are established. Bulletproof providers instead advertise anonymity, resistance to takedowns and the ability to keep customers’ infrastructure running despite complaints.
This makes them useful to criminal groups that need websites, phishing pages, malware servers and command-and-control infrastructure to remain online.
Taking down one provider can disrupt several criminal operations at once. However, operators may attempt to move their services to other hosting companies or infrastructure.
What This Means For You
The operation shows why cybercrime investigations increasingly target the infrastructure and service providers supporting criminal networks, rather than focusing only on individual hackers.
The seized customer records could help authorities identify operators behind phishing campaigns, ransomware infrastructure, infostealer distribution and online fraud services.
For ordinary internet users, disrupting these services may help reduce the availability of malicious websites and malware infrastructure. But a hosting provider’s takedown does not automatically remove malware already installed on victims’ devices or recover money stolen through earlier attacks.
TRM Labs has also cautioned that seizing a domain does not necessarily prove that the provider has stopped operating or that all its customers have lost access to underlying infrastructure. The long-term impact will depend on how effectively investigators use the seized data and whether the operators can rebuild elsewhere.
