FBI Seizes Virtualine Domain After Provider Led Bulletproof Hosting Sector in Illicit Inflows

On October 27, 2026, the FBI seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider whose direct customers included ransomware groups, an infostealer operator, and a Russian drug marketplace. In 2026, Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof hosting provider, despite receiving less total value than several peers.

Its customer mix shows the range of criminal services paying for this infrastructure. Ransomware groups accounted for about 5% of Virtualine’s direct inflows, while a Russian drug marketplace accounted for about 44%. A large sextortion scheme and a mixer were also major sources of funds.

The seizure disrupts Virtualine’s storefront. Its blockchain activity is a record of the financial relationships around the service — and a starting point for monitoring where funds and customers move next.

Key takeaways

• On October 27, 2026, the FBI seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider, in an operation with German, Dutch, and UK partners
• Virtualine received more illicit-attributed value than any other TRM-labeled bulletproof hosting provider in 2026 to date, despite ranking lower on total inflows
• A Russian drug marketplace accounted for about 44% of Virtualine’s direct inflows. Ransomware groups accounted for about 5%
• Virtualine’s direct counterparties also included a large sextortion scheme, a mixer, the StealC infostealer, and Volhav, another bulletproof hosting provider
• Across TRM-labeled bulletproof hosting providers, quarterly inflow value was about 4% higher in Q3 2026 than in Q1 2025, while incoming transfers were 60% higher

{{horizontal-line}}

The hosting infrastructure behind criminal services

Ransomware groups, malware operators, and illicit marketplaces need servers, domains, and network capacity to run their services. Bulletproof hosting providers sell access to that infrastructure while advertising resistance to abuse complaints and law enforcement requests.

US cybersecurity agencies describe bulletproof hosts as providers that do not engage in good faith with legal process or complaints from victims and third parties. Their joint guidance, Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers, published on November 19, 2025, identifies uses including fast-flux obfuscation, command and control, malware delivery, phishing, and hosting illicit content. These functions can support ransomware, data extortion, and denial-of-service attacks.

Customers pay for infrastructure they expect to remain available despite reports of abuse. That makes bulletproof hosts a shared dependency across several forms of cybercrime.

TRM labels dozens of bulletproof hosting providers, with a small group receiving most of the sector’s cryptocurrency inflows. Virtualine stands out within that group: it was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date.

F0XYF0X appears on this chart. Forum reports describe the name as banned after an alleged exit scam. Confirm the source before publication.

Across the labeled sector, quarterly inflow value changed relatively little between Q1 2025 and Q3 2026, ending about 4% above its starting level. Incoming transfers rose more substantially, ending 60% higher. Both measures fluctuated during the period.

Direct payers across the sector include ransomware groups such as Coinbase Cartel, The Gentlemen, INC, DragonForce, and Qilin, alongside malware operators such as the StealC infostealer and the Matanbuchus loader. Other counterparties include darknet markets, illicit goods and services operators, bot and malware-distribution services, and sites linked to child sexual abuse material. Mixers also account for a substantial portion of the funds reaching these providers.

Virtualine’s own inflows were concentrated in a drug marketplace, a sextortion scheme, and a mixer, with ransomware and malware operators accounting for smaller shares.

Virtualine’s service and customers

Virtualine joined the cybercrime forum Exploit on August 28, 2024 and claims to have operated since 2019. It advertises “off-shore web hosting, bulletproof cloud servers, bulletproof domains, and dedicated machines,” with prices starting at USD 0.79 per month.

The provider also claims that its collection of autonomous system numbers was the largest for malware and botnet hosting in 2025. Customers could reach it through two Telegram accounts. Reporting on the seizure lists Omegatech among the names used by the operator.

TRM’s analysis of Virtualine’s labeled Bitcoin addresses shows the services that paid it directly. These payments establish financial relationships with the host. They do not, by themselves, identify which attacks or services ran on its infrastructure.

A Russian drug marketplace accounted for about 44% of Virtualine’s direct inflows. A large sextortion scheme accounted for about 17%, sending funds between February and June 2026. The transfers do not state a purpose. A mixer accounted for about 13%. Ransomware groups accounted for about 5%.

Virtualine also received payments from the StealC infostealer throughout 2026. The transactions show a continuing financial relationship.

Another direct counterparty was Volhav, a second bulletproof hosting provider. That payment links Virtualine to other infrastructure in the same sector. Providers in this market resell infrastructure to one another.

What the seizure changes

The FBI Washington Field Office and the US Attorney’s Office for the Eastern District of Virginia announced the seizure of virtualine.net on October 27, 2026. Reporting on the announcement names Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, and the UK National Crime Agency as partners.

TRM was tracking Virtualine before the seizure. Its labeled addresses connect the provider to ransomware groups, an infostealer, a drug marketplace, a sextortion scheme, and other cybercrime services.

A domain seizure disrupts how customers find and access a service. It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.

The labeled addresses remain available for monitoring. Subsequent transactions can show withdrawals to know-your-customer (KYC) exchanges, continued payments to Virtualine’s known addresses, or financial links to other bulletproof hosting providers. Customer activity can also show movement to alternative hosts.

The existing transaction history already shows why Virtualine mattered. It was a financial point of connection for several kinds of criminal activity. Payments from a drug marketplace and a sextortion scheme accounted for a much larger share of its direct receipts than ransomware.

{{horizontal-line}}

Frequently Asked Questions (FAQs)

1. What is a bulletproof hosting provider?

A bulletproof hosting provider rents servers, domains, or network capacity while advertising resistance to abuse complaints and law enforcement requests. Criminal customers can use that infrastructure to host illicit services, deliver malware, and support attacks.

2. Who paid Virtualine?

Direct counterparties included a Russian drug marketplace, a large sextortion scheme, a mixer, five ransomware groups the StealC infostealer, and other cybercrime services. Ransomware groups accounted for about 5% of direct inflows, compared with about 44% from the Russian drug marketplace.

3. Does the seizure end Virtualine?

No. The domain seizure alone does not establish that Virtualine has ceased operating. Its labeled cryptocurrency addresses remain on-chain and can be monitored for subsequent activity.

4. Can TRM customers see this activity?

Yes. A graph of the Virtualine cluster is available in Graph Visualizer with a TRM license.