U.S.-Led Seizure Takes Down Virtualine Bulletproof Hosting Service Tied to Ransomware and Cybercrime

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities, the U.S. Department of Justice has confirmed. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities. According to the DOJ, Virtualine marketed services that permitted what it described as illegal and black hat activities, ranging from phishing, spamming, and carding to port scanning. The FBI seized the primary domain, virtualine.net, following an investigation that involved Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the U.K.'s National Crime Agency, and private partners OverRIPE and Lumen. Although Virtualine drew an apparent line at child content, authorities say the operator knowingly hosted an online forum promoting child abuse material and ignored repeated notices from law enforcement, the National Center for Missing and Exploited Children, and a victim's attorney. Authorities allege that after legal pressure against the forum increased, Virtualine worked with its administrators to set up a new site. The DOJ said Virtualine hosts that new website to this day, and that it has already received at least one abuse complaint about sexually explicit images of children found on the site. The Virtualine administrator rejected the allegations in an open letter to authorities published on a new website, virtualine.org, which was captured by cybersecurity company Silent Push. The operator said that while claims about the service's illegal activities and customers deserve a fair investigation, the service regards sexual exploitation of children as a crime against humanity. Virtualine also accepted direct Bitcoin payments from customers, which investigators say helped cybercriminals launder proceeds stolen elsewhere. Blockchain intelligence firm Chainalysis, which provided intelligence support to law enforcement, linked the service's payment addresses directly to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams, and phishing platforms. Chainalysis said Virtualine accepted direct bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without flagging their funds through hosted exchange compliance programs, and then laundered those proceeds to conceal their origin. In a report published on the day of the announcement, blockchain intelligence firm TRM said ransomware groups were responsible for 5 percent of Virtualine's financial flows, while a Russian drug marketplace accounted for approximately 44 percent. TRM said a large sextortion scheme and a mixer were also major sources of funds, and that Virtualine received payments from the StealC infostealer this year, with transaction patterns indicating a constant financial relationship. In a press release, the Dutch police said dozens of physical servers were seized in the province of Limburg, taking hundreds of virtual servers offline. Dutch investigators also said they recovered data on more than 3,000 Virtualine customers, and that follow-up action against them is underway. According to Dutch authorities, the illegal platform had been facilitating cybercrime operations since at least 2022, including ransomware, botnets, infostealers, phishing, and the distribution of child abuse material. Although the bulletproof hosting provider remains partially online, researchers observed that its network prefixes currently have very low routing visibility, suggesting that much of its infrastructure may no longer be reachable.