The FBI has seized the domain of Virtualine, a hosting provider accused of giving criminal gangs a safe place to run their operations online. The court-authorised seizure of virtualine.net was announced on 27 October 2026 by the US Attorney's Office for the Eastern District of Virginia and the FBI Washington Field Office, working with police in Germany, the Netherlands and the United Kingdom. So-called bulletproof hosts sell servers and domains while deliberately ignoring abuse complaints and law enforcement requests, allowing customers to keep illicit services running long after they would normally be taken down.

What prosecutors say Virtualine hosted

According to the Justice Department, Virtualine openly advertised its services to criminals on forums such as Exploit.in and HackForums, and its customers included ransomware operators, infostealer distributors, carding and credential-theft forums, scam operations and a forum prosecutors say sold sexually explicit images of minors. The provider also accepted direct bitcoin payments through unhosted wallets, and then laundered the proceeds. It later marketed a plan promising to move a customer's infrastructure to an unaffiliated shell company if law enforcement came calling.

Why the seizure matters — and what it does not do

Blockchain analysis firm TRM Labs found that Virtualine received more illicit-attributed cryptocurrency in 2026 than any other bulletproof host it tracks, even though it was not among the largest hosts by total inflows. A Russian drug marketplace accounted for about 44% of its direct receipts, a large sextortion scheme for about 17% and a cryptocurrency mixer for about 13%, while ransomware groups accounted for only about 5%, alongside the StealC infostealer and another hosting provider. The seizure knocks out the provider's public storefront, but researchers caution that a domain seizure alone does not prove the operator has stopped working or that customers have lost all of their infrastructure.

Sources: Chainalysis, TRM Labs.