The FBI seized virtualine.net, the web domain of Virtualine, on October 27, 2026, TRM Labs said. Virtualine is a Russian-speaking "bulletproof" host. It rents out servers and domains and says it will resist abuse complaints and police requests. TRM said reports on the announcement name police in Germany, the Netherlands and the UK as partners.
TRM said about 44% of Virtualine's direct payments came from a Russian drug marketplace. A sextortion scheme sent about 17%, a mixer (a service that hides where crypto came from) about 13%, and ransomware groups about 5%. TRM said a domain seizure hits how customers find the service. It does not by itself show the operator stopped, or that customers lost their servers. SecurityWeek reported that Virtualine still hosts one customer's new website. TRM said payments show money links, not which attacks ran on the servers. The sources do not mention arrests.
A seized domain removes the storefront, not necessarily the machines behind it. So it is weak proof that criminal capacity has shrunk. TRM notes that hosts in this market resell capacity to one another, and Virtualine received a payment from another bulletproof host, Volhav. Teams should ask whether their blocklists and threat intelligence track a domain or the hosting behind it.