FBI seizes virtualine.net in international bulletproof hosting operation

The U.S. Department of Justice announced Oct. 27 that it seized virtualine.net, a domain tied to the bulletproof hosting provider Virtualine, in an international law enforcement operation. The FBI led the seizure as part of Operation Omegaline with German, Dutch, and British authorities plus private partners OverRIPE and Lumen. The Justice Department had not identified Virtualine’s operators or announced criminal charges when the domain was seized.

Virtualine is a bulletproof hosting provider, a service that rents infrastructure based on a promise to ignore abuse complaints and law enforcement requests. The provider also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Prosecutors allege it advertised hosting for illegal and black hat activities including phishing, carding, e-mail spam, and port scanning.

In September 2024, Virtualine told a user on Exploit.in that the service could be used for all illegal or black hat activities except child contents and terrorism. “You can use Virtualine for all illegal/black hat activities,” the provider said. The provider later boasted on HackForums in June 2025 that it had ignored more abuse than the user’s last three therapists. Virtualine stated it would not serve customers tied to child abuse material or terrorism, but prosecutors allege it failed to enforce that ban.

Prosecutors allege Virtualine knowingly hosted Vendor 1, a forum that court records call criminal and where users sell access to material involving minors and adults. The U.S. Department of Justice said, “Virtualine knowingly hosted a website that did so, identified in court records as Vendor 1.” Law enforcement in Germany, Canada, and Australia, the National Center for Missing and Exploited Children, and a victim’s attorney sent numerous notices about child sexual abuse material in January 2026, but Virtualine continued to host Vendor 1. Prosecutors allege the host helped Vendor 1 build a new website for uploading and downloading illicit content, and the site remained hosted by Virtualine; in January 2026, roughly a month after giving Vendor 1 an IP address, Virtualine started getting notices about content involving minors on the server, prosecutors say.

According to prosecutors, Vendor 1 runs a hack-for-hire service where paying customers hire hackers to break into victims’ online accounts and steal explicit images and videos. Virtualine accepted payment through BTC [NO-AML], using unhosted bitcoin addresses so customers could pay directly without worrying their funds would be treated as illicit, the Justice Department said.

Prosecutors allege that funds paid to Virtualine by criminal customers were laundered to hide where they came from, and some payments trace back to criminal groups. Blockchain intelligence firm Chainalysis said Virtualine took direct Bitcoin payments via unhosted wallets, so criminal customers could pay without setting off compliance checks at hosted exchanges. Chainalysis said, “Virtualine accepted direct bitcoin payments through unhosted wallet addresses.”

TRM reported on October 28 that ransomware cartels made up 5% of Virtualine’s financial flows, with a Russian drug marketplace at roughly 44%. The firm also said no other bulletproof hosting provider it labels received more value tied to illicit sources in 2026 than Virtualine did.

Chainalysis said its blockchain analysis tied Virtualine to ransomware operators, infostealer systems, Russian-language cybercrime forums, shops selling illicit goods, and addresses used for scams and phishing. The DOJ announcement did not disclose a cryptocurrency seizure amount.

Internet Archive snapshots show standard plans costing between $19.99 per month and $179.99 per month. The $19.99-per-month standard plan included one virtual CPU with 2GB memory plus 30 GB storage. The top standard plan cost $179.99 per month and provided 24 vCPUs plus 64 GB memory together with 130 GB memory. Optimized plans for CPU, memory, and storage started at $21.99 per month and went up to $379.99 per month.

After the seizure, Virtualine’s operator released an open letter rejecting the claim that it knowingly carried child sexual abuse material, and stated that it answered CSAM cooperation requests within 24 hours. The operator said customer data was safe and said the service had been part of the operator’s life for five years.

In March 2026, Virtualine began selling an additional protection plan under which Virtualine would move a customer’s criminal infrastructure to an unaffiliated shell company after Virtualine received an official law enforcement request. The operator said the allegations deserve a fair investigation and called sexual exploitation of children a crime against humanity.

Visitors to virtualine.net now see a notice stating the domain was seized by the FBI. In September 2025, the Spamhaus Project said Virtualine expanded operations to AS209800, which is routed via aurologic GmbH. Researchers said Virtualine’s network prefixes currently show very low routing visibility, meaning much of the infrastructure may be unreachable. Silent Push said losing an ASN does not by itself mean a bulletproof host has stopped, and that obtaining a new ASN quickly is a key part of the problem; the firm said Omegatech’s network is partly still reachable but that its routing visibility has fallen very low.

In a Dutch police press release, authorities in Limburg seized dozens of physical servers, and hundreds of virtual servers went offline as a result. Dutch investigators retrieved customer data from over 3,000 Virtualine customers, Politie said, and follow-up steps against them are underway. According to Netherlands authorities, the illegal platform facilitated cybercrime operations starting in at least 2022, covering ransomware, botnets, infostealers, phishing, and child abuse material distribution.

Silent Push said it is tracking 50 bulletproof hosting providers that lost their network identifiers over the past year. A November 2025 joint advisory from CISA, the FBI, the UK’s NCSC, and other agencies says bulletproof providers can get a fresh ASN within two to five business days.

In February 2025, the U.S., UK and Australia took sanctions against Zservers over alleged support for the LockBit ransomware gang, and Dutch police took 127 of Zservers’ servers offline that same week. The U.S. Treasury Department sanctioned Russia-based Aeza Group in July 2025 over claims that it hosted the BianLian ransomware gang and malware that steals information; researchers also linked Aeza Group to the Doppelgänger disinformation campaign. In November, Media Land was sanctioned over alleged ties to ransomware cartels including LockBit, BlackSuit and Play, and U.S. prosecutors charged three alleged operators in the case, saying it resulted in roughly $62 million in losses for victims. Dutch authorities arrested two men in May and seized 800 servers in an investigation into infrastructure tied to Stark Industries, which faces EU sanctions and accusations of enabling Russian cyber operations; investigators said another company took over Stark’s infrastructure once the EU imposed sanctions.

Intel 471 reported in August that disruptions pushed customers toward newer providers run by former resellers, fragmenting the market instead of eliminating demand. It said the shifts fragment rather than end the bulletproof hosting market.