Virtualine’s shell-company plan shadows wider FBI seizure
The FBI seized Virtualine’s virtualine.net domain in a coordinated international operation; TRM Labs says the provider received nearly one-fifth of illicit-attributed inflows to bulletproof hosts it tracked in 2026 to date. Prosecutors allege Virtualine facilitated multiple forms of cybercrime and money laundering, while TRM traced payments from ransomware groups, malware services and a sextortion scheme.
In March, Virtualine advertised a plan to move customers’ criminal infrastructure to an unaffiliated shell company and reactivate the server after an official law-enforcement request. Prosecutors also say it kept a criminal forum online despite warnings and helped build another site. Seizing the domain removes a public-facing address; it does not show that hosted operations went offline.
For defenders tracking groups whose payments TRM linked to Virtualine, the seizure is a disruption, not proof that those groups or their infrastructure have disappeared. TRM says blockchain records persist and can trace where payments move next.
Officials seize domain of top bulletproof hosting provider Virtualine
The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers.
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.
FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering
The FBI seized the domain of a “bulletproof” hosting provider accused of facilitating a range of cybercrimes, including money laundering and the distribution of child sexual abuse material.