US law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service accused of supporting cybercrime, including ransomware, phishing, spamming, carding and port scanning. The international operation involved authorities in the United States, Germany, the Netherlands and the United Kingdom, along with private-sector partners, and resulted in physical servers being seized and hundreds of virtual servers going offline.
FBI seizes Virtualine domain
Virtualine also operated under the names Security, Massgod, Spamhouse, Lanedo and Omegatech. The service promoted itself on cybercrime forums by promising to shield customers from legal complaints and demands from law enforcement and other authorities.
The US Department of Justice (DOJ) said Virtualine sold services that enabled “illegal/blackhat activities,” including phishing, spamming, carding and port scanning.
The FBI seized the primary domain, virtualine.[.net], after an investigation involving Polizei Hessen in Germany, Polizei Midden-Nederland in the Netherlands, the UK’s National Crime Agency, and private partners OverRIPE and Lumen.
Source: BleepingComputer
Authorities allege hosting of child abuse material
Although Virtualine reportedly drew a line at child-related content, authorities say the operator knowingly hosted online forums promoting child abuse material. They also allege that the operator ignored repeated notifications from law enforcement, the National Center for Missing and Exploited Children (NCMEC) and attorneys representing victims.
Authorities claim Virtualine worked with forum administrators to establish a new site after legal pressure on the original forum increased.
“Virtualine continues to operate this new website to this day and has already received at least one complaint of abuse related to sexually explicit images of children found on the website,” the Department of Justice said.
Virtualine’s administrators denied the allegations in an open letter to authorities published on the new website, virtualine.[.]Organization. Cybersecurity company Silent Push captured the letter.
The operator said allegations of misconduct involving the service or its customers “deserve a fair investigation,” while stating that it considers “the sexual exploitation of children to be a crime against humanity.”
Virtualine’s links to the cybercrime ecosystem
Virtualine also accepted Bitcoin payments directly from customers, a practice that authorities and researchers say helped cybercriminals move and conceal proceeds stolen through other operations.
Chainalysis, a blockchain intelligence company that provided support to law enforcement, directly linked Virtualine payment addresses to ransomware operators, information-stealing infrastructure, Russian-language cybercrime forums, illegal shops, scams and phishing platforms.
“Virtualine now accepts Bitcoin payments directly through non-hosted wallet addresses, allowing criminal customers to pay without flagging their funds through hosted Exchange compliance programs,” a Chainalysis memo said.
“Virtualine then laundered those proceeds to hide their origin,” the blockchain intelligence company added.
In a report released on October 28, blockchain intelligence company TRM said ransomware groups accounted for 5% of Virtualine’s financial flows, while the Russian drug market accounted for approximately 44%.
“A large-scale sextortion scheme and mixer were also major sources of funding,” TRM said.
Source: TRM
TRM said Virtualine continued to receive payments from StealC infostealers in 2026, with the transactions indicating an ongoing financial relationship.
Servers seized and customer data recovered
A Dutch police press release said dozens of physical servers were seized in Limburg province, causing hundreds of virtual servers to go offline.
Dutch police also said researchers had recovered data from more than 3,000 Virtualine customers. Follow-up investigations into those customers are underway.
According to Dutch authorities, the illegal platform had facilitated cybercriminal activities—including ransomware, botnets, information theft, phishing and the distribution of child abuse material—since at least 2022.
Virtualine remains partially online, but researchers observed that routing visibility for its network prefixes is currently very low. That suggests much of the provider’s infrastructure may no longer be accessible.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com