FBI seizes Virtualine, a bulletproof host used by ransomware
The FBI has seized virtualine.net, a bulletproof host paid by ransomware and infostealer groups. How it worked, what is still online and what to check.
The US Department of Justice has announced the court-authorised seizure of the domain virtualine.net, used by Virtualine, a bulletproof hosting provider that also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Bulletproof services rent out servers, hosting and domains on the promise that they will ignore abuse complaints and law enforcement requests.
The investigation was led by the FBI Washington Field Office, with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK National Crime Agency and private partners OverRIPE and Lumen. Help Net Security gives the operation’s name, Omegaline. According to The Record, the Justice Department did not identify the operators or announce criminal charges at the time of the seizure.
How Virtualine operated
According to the court records cited by all sources, Virtualine recruited customers on cybercrime forums. In September 2024 it told an Exploit.in user that the service could be used for any illegal activity, including phishing, carding, spam and port scanning, with the sole exception of child abuse content and terrorism. In June 2025 it boasted on HackForums that it had “ignored more abuse than your last three therapists”.
From March 2026 it sold an “additional protection plan”: after the first official request from law enforcement, the customer’s infrastructure would be moved to a shell company not affiliated with Virtualine and the server reactivated. This is the mechanism that makes it hard to take malicious servers down through complaints alone.
Despite its stated rule, the government accuses Virtualine of knowingly hosting a criminal forum (called “Vendor 1” in the records) that sold intimate images of minors and adults and advertised a hack-for-hire service to break into victims’ accounts. From January 2026, warnings from police in Germany, Canada and Australia, from NCMEC and from a victim’s attorney did not lead to a takedown: according to the Justice Department, Virtualine instead helped the forum build a new site, which it still hosts.
The money flows
Payments also came through an option called “BTC [NO-AML]”: bitcoin addresses not held by a payment service, to avoid anti-money laundering checks. According to Chainalysis, which supported the investigation, Virtualine’s addresses are directly linked to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam and phishing campaigns.
TRM Labs, cited by BleepingComputer, CyberScoop and SecurityWeek, says Virtualine was not among the largest bulletproof providers by volume, but it received the most illicit-attributed value in 2026 among those it tracks: about one fifth of the total, according to CyberScoop. The split of direct payments: a Russian drug marketplace (about 44%), a large sextortion scheme (17%), a cryptocurrency mixer (13%), ransomware (5%), cybercrime services (3%) and malware (2%). Payers, according to CyberScoop, include the ransomware groups Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin, and the operators of the StealC infostealer and the Matanbuchu loader.
Servers seized in Europe
According to BleepingComputer, citing the Dutch police press release, dozens of physical servers were seized in Limburg, taking hundreds of virtual servers offline, and data on more than 3,000 Virtualine customers was recovered, with follow-up action against them under way. The Dutch police say the platform had been active since at least 2022. SecurityWeek reports that the service appeared on Exploit in 2024 but claimed to have been operating since 2019.
Wounded, not dead
Silent Push, cited by Help Net Security, had been tracking the network since 11 February 2026, when it saw infrastructure moving from Railnet, a known bulletproof provider, to a newly registered network called Omegatech. Within hours of the seizure, the operators published an open letter on a second domain, virtualine.org, rejecting the allegations and admitting they could rebrand and carry on in a day or less. Parts of the network remain reachable, but the routing visibility of their prefixes is very low, a sign that much of the infrastructure may no longer be active (Help Net Security and BleepingComputer).
TRM warns that a domain seizure disrupts how customers reach a service, but does not by itself show that the operator has stopped or that customers have lost all their infrastructure. According to Help Net Security, a joint advisory from CISA, the FBI, the UK NCSC and other agencies in November 2025 states that such providers can obtain a new autonomous system number (ASN) in two to five business days and move the same IP ranges over to it.
MITRE ATT&CK techniques
Our mapping: Virtualine’s customers used the service for T1583.003 (acquire virtual private servers), T1583.004 (servers) and T1583.001 (domains), that is infrastructure for phishing, malware and botnet command and control, and distribution sites.
Impact for European and Italian companies
The seized infrastructure was located at least partly in the Netherlands, and its customers include ransomware and infostealer groups that are also active in Europe. Addresses from providers like Virtualine often show up in firewall logs as sources of scans and login attempts, or as destinations for malware and phishing. For NIS2 entities it is a reminder: blocklists based on single IPs age quickly when a provider changes network within days.
What to do now
- Search DNS, proxy and firewall logs for connections to virtualine.net, virtualine.org and the networks named by Silent Push (Omegatech, Railnet), including past months.
- Block or monitor by ASN, not only by single IP: use reputation sources that track bulletproof provider networks, and check new assignments often.
- Treat outbound connections to low-reputation hosting networks as a possible sign of infostealers or command and control, StealC in particular.
- Check for lookalikes of your domain and phishing pages hosted on bulletproof networks, and ask registrars to take them down.
How ARXDOME helps
ARX Horizon enriches every event with country, operator and threat lists, so connections to low-reputation networks stand out in the SOC pages. ARX Radar recognises scans and brute force on the perimeter and shows each source’s dossier, with network and reputation. ARX Expose flags domains similar to yours registered by others.
Last updated:
