FBI Takes Virtualine Domain in Bulletproof Hosting Investigation
The U.S. Federal Bureau of Investigation has seized the virtualine.net domain as part of an international operation involving a bulletproof hosting provider known as Virtualine. The U.S. Department of Justice said the action addressed alleged use of the service for criminal hosting and international money laundering, while the domain now displays an FBI seizure notice.
The operation involved the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE and Lumen Technologies. The Justice Department said Virtualine was associated with the names Secury, Massgod, Spamhouse, Lanedo and Omegatech.
Allegations centre on abuse-tolerant infrastructure
Court documents cited by the Justice Department state that Virtualine promoted services on cybercrime forums for phishing, carding, email spam and port scanning, while claiming to prohibit child content and terrorism-related activity. In June 2025, the provider allegedly wrote on HackForums that it ignored more abuse than its competitors.
The provider also began advertising an additional protection plan in March that purported to move customers’ infrastructure to a shell company unaffiliated with Virtualine when law-enforcement requests arrived. Archived pricing showed standard plans ranging from $19.99 per month for one virtual CPU, 2GB of memory and 30GB of storage to $179.99 per month for 24 vCPUs, 64GB of memory and 130GB of storage.
The Justice Department alleged that Virtualine knowingly hosted a criminal forum identified as Vendor 1 despite notices concerning sexually explicit material involving minors. It said the provider received notifications in January 2026, roughly a month after assigning Vendor 1 an IP address, and subsequently received notices from law enforcement bodies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children, and a victim’s attorney.
Bitcoin payments and infrastructure resilience
Virtualine accepted several payment methods, including BTC [NO-AML], which the Justice Department described as specific unhosted Bitcoin addresses enabling direct payment without concern that funds would be flagged as illicit. The department alleged that some payments could be traced to criminal groups and were further laundered to conceal their origin.
Chainalysis said Virtualine’s on-chain activity had direct exposure to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scam operations and phishing addresses. The firm said unhosted wallet payments could allow customers to avoid compliance checks typically applied by hosted exchanges.
Virtualine’s operator rejected the allegation that the company knowingly hosted child sexual abuse material. In an open letter and a Telegram post, the operator said requests involving such material were handled within 24 hours, claimed the Vendor 1 relationship had been ended after prohibited material was identified, and stated that customer data remained safe.
Network identifiers can be replaced
The seizure does not by itself resolve the broader issue of criminal infrastructure moving between networks. The Spamhaus Project reported in September 2025 that Virtualine had expanded to AS209800, while Silent Push warned that the ability to obtain a replacement autonomous system number quickly is a central part of the problem.
For businesses, the case reinforces the need to assess hosting suppliers beyond price and capacity. Abuse-response practices, payment arrangements, network ownership and a provider’s history of infrastructure changes are practical indicators to review before placing important services with a host.