FBI seizes Virtualine domain under court order

The FBI and the Justice Department seized the virtualine.net domain of bulletproof hosting provider Virtualine, a service that ignores abuse complaints and law-enforcement requests, on Oct. 27, 2026, under a court order, and replaced the provider’s website with an FBI seizure notice. Virtualine also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. Prosecutors allege Virtualine enabled large-scale sextortion, ransomware campaigns, data theft, malware hosting, money laundering and child sexual abuse material distribution. The Justice Department announced no criminal charges and did not identify Virtualine’s operators.

TRM Labs attributed nearly one-fifth of all illicit-attributed cryptocurrency inflow among tracked bulletproof hosting providers to Virtualine in 2026 to date, more than any other labeled host even with lower total inflows. Ransomware cartels including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid Virtualine’s operators, and ransomware cartels accounted for nearly 5% of direct inflows in 2026 to date. A Russian drug marketplace made up nearly 44% of direct payments, a sextortion scheme nearly 17%, and a cryptocurrency mixer almost 13%. “Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” said Ari Redbord, global head of policy at TRM Labs.

The FBI’s Washington Field Office led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency, OverRIPE and Lumen, and the Justice Department’s Office of International Affairs assisted. The FBI dubbed the probe Operation Omegaline. First Assistant U.S. Attorney for the Eastern District of Virginia Theophani K. Stamos and FBI Washington Field Office Assistant Director in Charge Darren B. Cox announced the seizure, while Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz represent the government.

Prosecutors allege Virtualine knowingly hosted Vendor 1, a criminal forum selling access to explicit sexual images and videos involving minors and adults. Vendor 1 also promoted a hack-for-hire service through which customers could pay hackers to access victims’ online accounts and obtain explicit images and videos. Police in Germany, Canada and Australia, the National Center for Missing and Exploited Children and a victim’s attorney notified Virtualine about child sexual abuse material on Vendor 1’s server in January 2026. Court records indicate Virtualine assigned an IP address to Vendor 1 around December 2025.

Even after receiving abuse notices, Virtualine kept Vendor 1 online and helped its operators create another site for uploading and downloading illicit content, the Justice Department said. At least one abuse complaint about sexually explicit images of children had already reached the new Vendor 1 site.

The operator posted an open letter on virtualine.org disputing the allegations, saying it acted on complaints about child sexual abuse material within 24 hours and that Virtualine cut ties with customers tied to prohibited material. The operator also said the allegations deserve a fair investigation and described sexual exploitation of children as a crime against humanity. The operator said customers who trusted the service should not face suspicion over conduct linked to a single customer. Virtualine claimed its rules prohibited child sexual abuse material and terrorism-related content in September 2024.

Customers could pay in Bitcoin through unhosted wallet addresses using an option labeled BTC [NO-AML], which bypassed hosted-exchange compliance checks. Prosecutors allege Virtualine took payments from criminal customers and laundered the money to hide where it came from.

Virtualine sold hosting, servers and domain registrations to customers recruited on cybercrime forums, promising to shield them from abuse complaints and law enforcement requests. Dutch authorities say Virtualine has facilitated cybercrime operations including ransomware, botnets, infostealers, phishing and child abuse material distribution since at least 2022. Virtualine also transacted with services and sites tied to child sexual abuse material that distribute bots and malware.

In September 2024, the provider told an Exploit.in user that its infrastructure could support phishing, payment card fraud, e-mail spam and port scanning. The provider boasted on HackForums in June 2025 about ignoring more abuse complaints than the user’s last three therapists. It marketed an add-on protection plan in March 2026 to shift customers’ criminal infrastructure to another shell company following a law enforcement request.

Dutch police seized dozens of physical servers in Limburg, knocked hundreds of virtual servers offline and recovered data from more than 3,000 Virtualine customers. Follow-up action against those more than 3,000 customers is underway, Dutch police said.

Virtualine’s network prefixes have low routing visibility, researchers observed, though parts of the network remain reachable and the service is still partly online. A domain seizure disrupts customer access to and discovery of a service, TRM Labs said, but it does not prove the operator has stopped working. TRM Labs said Virtualine topped SecureHost, vpsbg, F0XYF0X BPH and Gerry for illicit-attributed cryptocurrency in 2026 even with lower total inflows.

The operator’s open letter said Virtualine could rebrand, create a new website and keep operating, possibly in a day or less, and assured Telegram followers that customer data was safe. By Oct. 29, 2026, virtualine.org and the operator’s Telegram channel were no longer accessible. “Virtualine hosts this new website to this day,” the U.S. Department of Justice said.

Internet Archive snapshots show standard plans costing $19.99 to $179.99 per month and optimized plans costing $21.99 to $379.99 per month. The entry-level standard plan cost $19.99 per month and came with one virtual CPU, 2GB of memory and 30GB of storage. The top standard plan cost $179.99 per month with 24 vCPUs, 64GB memory and 130GB memory. “Virtualine has been part of my life for five years,” the operator said.

Virtualine received payments from the StealC infostealer and the Matanbuchu loader this year, transactions that show a constant financial relationship. TRM Labs said Virtualine also took payments from the Matanbuchus loader. The Justice Department said it did not name specific ransomware cartels or reveal the total value of the payments.

The seizure follows earlier international action against other bulletproof hosts. Dutch police seized 127 servers from Zservers, which the U.S., UK and Australia placed under sanctions in February 2025 over alleged support for the LockBit ransomware cartel. The U.S. Treasury Department sanctioned Russia-based Aeza Group in July 2025 over alleged support for BianLian ransomware and information-stealing malware, and researchers later linked Aeza to the Doppelgänger disinformation campaign. The U.S., UK and Australia sanctioned Media Land in November 2025 over alleged ties to LockBit, BlackSuit and Play, and Dutch authorities arrested two men and seized 800 servers in May while investigating Stark Industries.

Intel 471 reported in August that disruptions pushed customers toward newer providers run by former resellers, fragmenting the market rather than eliminating demand. Silent Push said 50 bulletproof hosting providers on its radar lost network identifiers, known as ASNs, within the past 12 months. Losing an ASN does not by itself mean a bulletproof host has stopped working, the company said.

Silent Push said it began tracking Virtualine’s network on Feb. 11, 2026, when infrastructure moved from Railnet to a newly registered network called Omegatech. Spamhaus said in September 2025 that Virtualine expanded to AS209800, routed via aurologic GmbH and using IPv4 prefixes from Turkey- and U.S.-based brokers. A November 2025 advisory from CISA, the FBI and the UK’s NCSC warned that providers can obtain a new ASN in two to five business days.

Chainalysis supported the investigation and tied Virtualine payment addresses to scams, phishing, illicit shops, forums used by Russian-language cybercriminals, infostealer infrastructure and ransomware operators. The firm also said contact with suspicious Bitcoin addresses does not prove every payment or customer participated in a crime.