The U.S. Department of Justice (DoJ) has announced the seizure of a domain linked to Virtualine, a bulletproof hosting provider accused of supporting criminal activities, including the distribution of child sexual abuse material, the nonconsensual sharing of intimate images, and international money laundering.
The domain, virtualine[.]net, now displays a seizure notice from the U.S. Federal Bureau of Investigation (FBI). The operation involved multiple international law enforcement agencies and private-sector partners, including the Hessen State Police in Germany, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.
According to court documents, Virtualine also operated under several other names, including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. The provider allegedly promoted its hosting services on cybercrime forums, advertising their suitability for phishing, carding, email spam, and port scanning while claiming to prohibit child exploitation material and terrorism-related activities.
In June 2025, Virtualine allegedly advertised its approach to abuse complaints on HackForums, claiming that it ignored more abuse reports than other providers. In March 2026, it reportedly introduced an additional protection plan promising to transfer customers’ criminal infrastructure to a shell company unaffiliated with Virtualine if law enforcement agencies submitted official requests.
Archived website snapshots show that Virtualine offered virtual private server plans starting at $19.99 per month, with higher-tier configurations costing up to $179.99 per month. It also advertised specialized plans optimized for CPU, memory, and storage, with prices reaching $379.99 per month.
The Justice Department alleges that Virtualine knowingly continued hosting a criminal online forum identified in court records as “Vendor 1,” despite receiving multiple reports about illegal content. The forum allegedly allowed users to post and sell access to nude, sexually suggestive, and sexually explicit images and videos involving minors and adults. It also reportedly promoted a hack-for-hire service through which customers could pay individuals to access victims’ online accounts without authorization and obtain intimate material.
According to the DoJ, Virtualine assigned an IP address to Vendor 1 in December 2025 or around that period, and began receiving notifications about sexually explicit images and videos involving minors in January 2026. The department said the provider continued hosting the service despite receiving notices from law enforcement agencies in Germany, Canada, and Australia, as well as the U.S. National Center for Missing and Exploited Children and a victim’s attorney.
Investigators also accused Virtualine of working closely with Vendor 1 to develop a website where customers could upload illicit content and download it after completing a purchase. The DoJ said the website continued to be hosted by Virtualine.
The investigation also highlighted the provider’s payment practices. According to the Justice Department, Virtualine accepted Bitcoin payments through specific unhosted wallet addresses, allowing customers to pay directly without going through hosted cryptocurrency exchanges that might flag suspicious transactions. Investigators allege that the provider subsequently laundered funds received from criminal customers to conceal their origins.
Blockchain intelligence firm Chainalysis said Virtualine’s cryptocurrency activity connected it to a broad range of cybercrime operations, including ransomware groups, infostealer infrastructure, Russian-language cybercrime forums, illicit marketplaces, and scam and phishing addresses.
Following the seizure, the operator of Virtualine published an open letter disputing the allegations that the service knowingly hosted child sexual abuse material. The operator claimed that requests involving such material had been addressed within 24 hours and said the relationship with the customer identified as Vendor 1 had been terminated after prohibited material was discovered. The operator also stated that they were prepared to cooperate with authorities and insisted in a Telegram post that customer data remained safe.
The seizure follows earlier concerns about Virtualine’s infrastructure and its ability to continue operating despite enforcement actions. In September 2025, the Spamhaus Project reported that the provider had expanded its operations to autonomous system number AS209800. It also pointed to the role of IP address brokers and hosting providers in enabling the continued allocation and routing of infrastructure associated with internet abuse.
Security firm Silent Push noted that losing an autonomous system number does not necessarily stop a bulletproof hosting provider from operating. The company argued that the speed at which such providers can obtain replacement network infrastructure remains a major challenge for law enforcement and the wider cybersecurity industry.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
