FBI seizes Virtualine, a bulletproof host accused of sheltering cybercrime and laundering Bitcoin
The main domain of a hosting provider that openly courted criminals went dark this week after U.S. authorities seized it in an international operation. The case is a useful reminder that the infrastructure behind phishing, infostealers and ransomware is a business, and that business has paying customers.
What happened
The U.S. Department of Justice announced on Tuesday that the FBI had seized virtualine[.]net, the storefront of a bulletproof hosting (BPH) provider known as Virtualine. Anyone visiting the domain now sees a seizure notice citing a warrant from the Eastern District of Virginia and an effort dubbed "Operation Omegaline", carried out together with police in Germany and the Netherlands, the UK's National Crime Agency and private-sector partners.
Court filings describe a provider that also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech. It advertised on cybercrime forums as a place to run phishing, carding, spam and port-scanning operations, with child abuse material and terrorism as the only stated exceptions. Ignoring abuse complaints was treated as a selling point. From March this year the service even sold an "additional protection" tier that promised to migrate a customer's infrastructure to an unrelated shell company whenever law enforcement sent a request. Plans were priced like any mainstream VPS host.
The "Vendor 1" allegations
The gravest allegation concerns a customer identified in the filings only as "Vendor 1": a forum where users bought and sold sexually explicit images of minors and adults, and which also offered a hack-for-hire service to break into victims' accounts. Prosecutors say Virtualine started receiving reports about abuse material on that server within about a month of assigning it an IP address, and kept it online despite notices from law enforcement in Germany, Canada and Australia, from the U.S. National Center for Missing and Exploited Children, and from a victim's lawyer. The department further alleges that Virtualine helped the same customer build a new upload-and-sell site, which was still being hosted when the seizure took place.
Follow the money
The warrant is not only about hosting. Prosecutors say Virtualine accepted payment to unhosted Bitcoin addresses explicitly marketed as having no anti-money-laundering checks, so customers could pay without a regulated exchange flagging the funds. Part of that money is said to be traceable directly to criminal groups and to have been laundered afterwards to hide its origin. Blockchain analysis of the provider's wallets shows exposure to ransomware operators, infostealer infrastructure, Russian-language crime forums, illicit shops and phishing addresses.
The operator's response
The person running Virtualine has published an open letter rejecting the claim that the service knowingly hosted child sexual abuse material. The letter states that the relationship with "Vendor 1" ended once prohibited content was identified, that CSAM-related requests were handled within 24 hours, and that customer data is safe. These are allegations at this stage, and none of them has yet been tested in court.
Why it matters
Bulletproof hosts are the landlords of cybercrime. The phishing page that targets your staff, the command-and-control server that collects infostealer logs and the panel behind a ransomware affiliate all need somewhere to live, and they need a landlord who will not answer takedown requests. Operations like this raise the cost of that service.
They rarely end it, though. Virtualine had already demonstrated how resilient a BPH can be: in autumn 2025 it moved onto a new autonomous system, AS209800, using IPv4 space obtained through address brokers with loose customer vetting and routed via an upstream that also carries other bulletproof operations. A seized domain or a lost ASN is a setback, not a shutdown. The ease of registering fresh network resources is the structural problem, and it has not gone away.
What to do
- Treat known bulletproof ranges as hostile. Block or alert on AS209800 and associated prefixes at the perimeter and in your email and web gateways, and keep your bulletproof-hosting threat-intel feeds current, since these operators change addresses often.
- Assume phishing and infostealer infrastructure will keep appearing. Enforce phishing-resistant MFA, shorten session lifetimes and treat credentials found in stealer logs as compromised the moment they surface.
- Report abuse and keep the receipts. When you find infrastructure abusing your brand, file complaints with the upstream provider and the relevant authorities. Providers that systematically ignore those notices are exactly what this warrant targeted.
- Look at the problem from the criminal side. Your domains, employee credentials and brand are already being discussed on the forums and markets that this kind of hosting serves. Our Deep/Dark Web monitoring service watches those criminal forums, markets and leak channels for your organisation's footprint, so you learn about exposure before someone pays to use it.