US Authorities Seize Domain of Virtualine, a Hosting Service Used by Ransomware and Sextortion Gangs

The US Justice Department said on Tuesday that authorities had seized the domain of Virtualine, a bulletproof hosting provider. Bulletproof hosting services give cybercriminals a place to run their operations. According to the Justice Department, Virtualine was used for a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering. It also facilitated the distribution of child sexual abuse material. The FBI and prosecutors obtained a court order to seize its primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

Blockchain research firm TRM Labs said Virtualine was not among the largest providers it tracks by total inflows, but it received the most illicit-attributed value in 2026 so far, almost one-fifth of the total among tracked providers. A Russian drug marketplace made up nearly 44% of direct payments from customers and attributed counterparties. A sextortion scheme accounted for nearly 17%, a cryptocurrency mixer almost 13%, ransomware nearly 5%, cybercrime services 3% and malware 2%.

TRM said ransomware groups including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid Virtualine's operators. It also received payments linked to the StealC infostealer and the Matanbuchu loader. Ari Redbord of TRM Labs noted that a domain seizure matters, but the blockchain record remains, showing who is paying, who is getting paid and where the money goes next.