FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering
The U.S. Department of Justice has seized the domain of a bulletproof hosting provider named Virtualine, accusing the service of facilitating prolific criminal activity.
The U.S. Department of Justice (DoJ) announced on Tuesday the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was part of a coordinated operation involving international law enforcement agencies and private sector entities.
Visitors to the "virtualine[.]net" domain are now greeted by a message stating it has been seized by the U.S. Federal Bureau of Investigation. The operation included the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.
Allegations of Criminal Activity
The DoJ alleges that Virtualine was used to commit and facilitate prolific criminal activity. The service advertised its capabilities to criminals on cybercrime forums, claiming it could be used for phishing, carding, email spam, and port scanning, with the exception of child content and terrorism activities.
According to court documents, Virtualine also operated under several other names, including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. The provider advertised plans ranging from $19.99 per month for one virtual CPU and 2GB memory to $379.99 per month for 24 vCPUs and 64 GB of memory.
Vendor 1 is a criminal online forum that allows users to post and sell access to nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults. The forum also promotes a hack-for-hire service where users can pay hackers to access victims' online accounts without their consent.
The DoJ stated that Virtualine continued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; and a victim's attorney.
Bitcoin Money Laundering
Virtualine accepted payment through BTC [NO-AML], specific unhosted Bitcoin addresses that allowed customers to pay without concern their funds would be flagged as illicit. The funds Virtualine's criminal customers paid to the provider were then further laundered to conceal the origin of the funds.
Blockchain intelligence firm Chainalysis noted that Virtualine accepted direct Bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without triggering compliance checks at hosted exchanges. The firm's analysis showed Virtualine's on-chain footprint had direct exposure to a broad cross-section of the cybercrime ecosystem.
The DoJ added that Virtualine.net included a number of payment options for its customers, including Vendor 1. The provider has also been accused of working closely with Vendor 1 to create a new website where its clients could upload their illicit content and download it upon completing a purchase.
Operator's Response
Following the site seizure, the operator of Virtualine has published an open letter, refuting allegations that the service knowingly hosted child sexual abuse material (CSAM). The operator claimed they have taken action on requests for cooperation concerning CSAM within 24 hours.
In a post shared on their Telegram channel, the operator insisted that customer data was safe. They stated, "When we identified prohibited material associated with the customer described as 'Vendor 1,' we ended our relationship with that customer."
"Please do not cast suspicion on me and the tens of thousands of customers who have trusted Virtualine because of the actions attributed to a single customer. I want you to know that I am prepared to respond to your requests concerning 'Vendor 1.'"
The operator further claimed, "Virtualine has been part of my life for five years." In September 2025, the Spamhaus Project revealed that Virtualine had expanded their operations to AS209800.
Future of Bulletproof Hosting
The operator of AS209800 is routed via aurologic GmbH, a hosting provider proliferating several other bulletproof hosting operations. Cybersecurity researcher Silent Push noted that a lost ASN does not by itself mean the BPH has stopped.
The speed of acquiring a new ASN is a crucial part of the problem, and Silent Push believes the process for registering an ASN should be tougher. The operator's claims that they ended their relationship with the offending customer do not address the broader allegations of facilitating criminal infrastructure.
Related
