The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine.
The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct," the DoJ said.
Visitors to the "virtualine[.]net" domain are now greeted by a message that states it has been seized by the U.S. Federal Bureau of Investigation as part of a coordinated operation between international law enforcement agencies and private sector entities, including the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.
According to court documents, Virtualine, which also operated as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, advertised its services to criminals on cybercrime forums, claiming that they can be used for phishing, carding, email spam, and port scanning, with the exception of child content and terrorism activities.
In June 2025 on HackForums, the provider is alleged to have boasted that "Virtualine ignored more abuse than your last three therapists." Earlier this March, it also began marketing an "additional protection plan" that promised its customers to move their criminal infrastructure to a shell company unaffiliated with Virtualine when receiving official requests from law enforcement agencies.
Snapshots captured by the Internet Archive show that standard plans cost anywhere between $19.99 per month for one virtual CPU, 2GB memory, and 30 GB storage to $179.99 per month for 24 vCPUs, 64 GB memory, and 130 GB memory. Virtualine also offered plans optimized by CPU, memory, and storage, starting from $21.99 per month to $379.99 per month.
"Despite advertising that it does not allow 'child contents' on its server, Virtualine knowingly hosted a website that did so, identified in court records as Vendor 1," DoJ said. "Vendor 1 is a criminal online forum that allows users to post and sell access to nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults."
"Vendor 1 also promotes a hack-for-hire service in which users can pay hackers to access victims’ online accounts without their consent and illicitly obtain explicit images and videos. In January 2026, about one month after Virtualine assigned an IP address to Vendor 1, Virtualine began receiving notifications about sexually explicit images and videos of minors on that server."
The Justice Department said Virtualine continued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; and a victim's attorney.
Virtualine has also been accused of working closely with Vendor 1 to create a new website where its clients could upload their illicit content and download it upon completing a purchase. The website continues to be hosted by Virtualine to this day, the department added.
"Virtualine.net included a number of payment options for Virtualine's customers, including Vendor 1," the DoJ said. "Virtualine accepted payment through BTC [NO-AML], specific unhosted bitcoin addresses that allowed customers to direct pay without concern their funds would be flagged as illicit."
"The funds Virtualine's criminal customers paid to Virtualine, some of which can be traced directly to various criminal groups, were received by Virtualine and then further laundered to conceal the origin of the funds."
Blockchain intelligence firm Chainalysis, in its own analysis, said Virtualine accepted direct Bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without triggering compliance checks at hosted exchanges.
"Virtualine's on-chain footprint has direct exposure to a broad cross-section of the cybercrime ecosystem, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses," it said.
Following the site seizure, the operator of Virtualine has published an open letter, refuting allegations that the service knowingly hosted child sexual abuse material (CSAM). The operator also claimed they have taken action on requests for cooperation concerning CSAM within 24 hours. In a post shared on their Telegram channel, they insisted that customer data was safe.
"When we identified prohibited material associated with the customer described as 'Vendor 1,' we ended our relationship with that customer," the individual added, claiming "Virtualine has been part of my life for five years."
"Please do not cast suspicion on me and the tens of thousands of customers who have trusted Virtualine because of the actions attributed to a single customer. I want you to know that I am prepared to respond to your requests concerning 'Vendor 1.'"
In September 2025, the Spamhaus Project revealed that Virtualine had expanded their operations to AS209800. "Thanks to Turkey- and U.S.-based IP address brokers with poor customer vetting procedures, Virtualine keeps obtaining new IPv4 prefixes for enabling internet abuse. AS209800 is currently routed via aurologic GmbH, a hosting provider proliferating several other bulletproof hosting operations."
"A lost ASN does not by itself mean the BPH has stopped," Silent Push said. "The speed of acquiring a new ASN is a crucial part of the problem, and we believe the process for registering an ASN should be tougher."
Update
According to an analysis published by TRM Labs, Virtualine received more illicit-attributed cryptocurrency than any other labeled bulletproof host in 2026, surpassing SecureHost, vpsbg, F0XYF0X BPH (aka Bearhost), and Gerry, despite lower total inflows.
A Russian drug marketplace accounted for nearly 44% of direct inflows, while a large sextortion scheme, a mixer, and ransomware groups were responsible for about 17%, 13%, and 5%, respectively. Direct payers include Coinbase Cartel, The Gentlemen, INC, DragonForce, and Qilin, alongside malware operators such as the StealC infostealer and the Matanbuchus loader.
Other counterparties that have transacted with Virtualine are darknet markets, illicit goods and services operators, bot and malware-distribution services, and sites linked to child sexual abuse material.
"Virtualine is another example of Russia's illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem," Ari Redbord, global head of policy at TRM Labs, said in a statement shared with The Hacker News.
"Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn't disappear with it. It shows who is paying, who is getting paid, and where they go next."
A press release from the Dutch police has revealed that dozens of physical servers located in a data center in Limburg were seized in Limburg, taking hundreds of virtual servers offline.
"Through the seizure, the police are in possession of data and information relating to more than 3,000 customers who used the servers for criminal activities," the Politie said. "The secured data will be used for further police investigation regarding customers who used these servers for criminal purposes."
As of October 29, 2026, virtualine[.]org, the domain that hosted the open letter, and the Telegram channel are no longer accessible.
