593/69 Friday, October 30, 2026
The U.S. Federal Bureau of Investigation (FBI), working with international law enforcement agencies, has seized the primary domain of Virtualine, a bulletproof hosting provider allegedly used to support cybercriminal activity. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and advertised on cybercrime forums that it could protect customers from legal complaints and law enforcement requests. The U.S. Department of Justice (DOJ) stated that Virtualine allowed customers to use its infrastructure for illegal activities including phishing, spam, carding, and port scanning. The FBI seized the virtualine[.]net domain in cooperation with German police, Dutch police, the United Kingdom’s National Crime Agency (NCA), and private-sector partners including OverRIPE and Lumen.
Investigators found that Virtualine was linked to infrastructure used for ransomware, botnets, infostealers, and phishing, as well as the distribution of child sexual abuse material. Authorities alleged that the provider was aware its hosting services were being used to distribute illegal content but failed to act on repeated abuse notifications and even helped website operators establish new sites after facing legal pressure. Virtualine’s operators have denied the allegations through a newly created website. Meanwhile, blockchain intelligence company Chainalysis reported Bitcoin transactions linking Virtualine to ransomware groups, infostealer infrastructure, illicit marketplaces, and scam platforms. The service reportedly accepted payments through unhosted wallets and was associated with money laundering activity intended to obscure the source of funds. TRM reported that approximately 5% of financial flows linked to Virtualine came from ransomware groups, while around 44% was associated with a Russian illicit drug marketplace. Transactions linked to the StealC infostealer were also identified.
Dutch police stated that authorities seized dozens of physical servers in the province of Limburg, causing hundreds of virtual servers to go offline. Investigators also obtained information related to more than 3,000 Virtualine customers for use in further investigations and potential enforcement actions. Authorities said the platform had supported cybercriminal activity since at least 2022. Although some parts of Virtualine’s services reportedly remain online, researchers observed a significant decline in network accessibility, indicating that much of its infrastructure may no longer be operating normally. The operation is intended to reduce the capabilities of bulletproof hosting providers that enable cybercriminals to conduct attacks and evade oversight by law enforcement and other relevant authorities.