U.S. DOJ Seizes Virtualine Domain Over Alleged Criminal Hosting and Money Laundering

The U.S. Department of Justice (DoJ) has announced the seizure of a domain associated with Virtualine, a bulletproof hosting provider accused of knowingly supporting criminal activity, including the distribution of child sexual abuse material (CSAM), nonconsensual sharing of intimate images, and international money laundering.

The domain, virtualine.net, now displays a seizure notice from the U.S. Federal Bureau of Investigation (FBI). The action was carried out as part of an international law enforcement operation involving agencies and private-sector organizations from the United States, Germany, the Netherlands, and the United Kingdom, alongside OverRIPE and Lumen Technologies.

Virtualine Allegedly Marketed Hosting Services to Cybercriminals

According to court documents, Virtualine also operated under several other names, including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. The provider allegedly advertised its services on cybercrime forums, promoting infrastructure that could be used for phishing, carding, email spam, and port scanning.

In June 2025, the provider allegedly boasted on HackForums that it ignored more abuse reports than other hosting companies. In March 2026, it reportedly began advertising an additional protection plan that promised to transfer customers' criminal infrastructure to an unaffiliated shell company if law enforcement agencies made official requests.

Archived snapshots of Virtualine's website show that its standard virtual server plans ranged from $19.99 per month for a configuration with one virtual CPU, 2 GB of memory, and 30 GB of storage to $179.99 per month for a plan with 24 virtual CPUs and 64 GB of memory. The company also offered resource-optimized plans priced between $21.99 and $379.99 per month.

Authorities Allege Hosting of Illegal Content Despite Abuse Reports

The DoJ alleges that Virtualine knowingly hosted a criminal online forum identified in court documents as "Vendor 1." The forum allegedly allowed users to post and sell access to nude, sexually suggestive, and sexually explicit images and videos involving minors and adults.

According to investigators, Vendor 1 also promoted a hack-for-hire service through which customers could pay hackers to access victims' online accounts without authorization and obtain intimate images and videos.

Virtualine reportedly assigned an IP address to Vendor 1 in late 2025 or early 2026. In January 2026, approximately one month after the assignment, the hosting provider allegedly began receiving notifications about sexually explicit images and videos of minors stored on the server.

The Justice Department said the provider continued hosting the service despite receiving multiple notifications from law enforcement agencies in Germany, Canada, and Australia, as well as the U.S. National Center for Missing and Exploited Children (NCMEC) and a victim's attorney.

Authorities further allege that Virtualine worked closely with Vendor 1 to develop another website where customers could upload illicit content and download it after completing a purchase. The DoJ stated that this website remained hosted by Virtualine at the time of its announcement.

Bitcoin Payments Allegedly Helped Conceal Criminal Proceeds

Investigators also accused Virtualine of accepting cryptocurrency payments in ways that helped customers avoid conventional compliance checks.

According to the DoJ, the provider accepted Bitcoin payments through specific unhosted wallet addresses, allowing customers to pay directly without using hosted exchanges that might flag suspicious transactions.

The department alleges that payments from criminal customers, some reportedly traceable to criminal groups, were subsequently laundered to conceal their origins.

Blockchain intelligence firm Chainalysis said Virtualine's on-chain activity connected it to a broad range of cybercrime operations, including ransomware groups, infostealer infrastructure, Russian-language cybercrime forums, illicit marketplaces, scams, and phishing operations.

The findings highlight how bulletproof hosting providers can supply infrastructure and payment arrangements that make it harder for investigators to disrupt criminal services and trace their financial activity.

Virtualine Operator Disputes the Allegations

Following the domain seizure, the operator of Virtualine published an open letter disputing the allegation that the service knowingly hosted child sexual abuse material.

The operator claimed that Virtualine had responded to requests concerning CSAM within 24 hours and had ended its relationship with the customer associated with Vendor 1 after identifying prohibited material. The operator also stated that customer data remained safe.

In the statement, the operator asked the public not to judge the service or its wider customer base based on allegations involving a single customer and expressed a willingness to cooperate with authorities concerning Vendor 1.

These statements represent the operator's response to the allegations. The claims have not been independently established by the operator's public statement.

Previous Warnings Highlighted Virtualine's Infrastructure Changes

Virtualine had attracted attention from cybersecurity organizations before the domain seizure.

In September 2025, the Spamhaus Project reported that Virtualine had expanded its operations to autonomous system number (ASN) AS209800. The organization attributed the provider's ability to obtain new IPv4 address ranges partly to weak customer-vetting practices among certain IP address brokers.

Security firm Silent Push subsequently noted that losing an ASN does not necessarily shut down a bulletproof hosting operation. Providers may acquire new network resources and resume operations under different infrastructure, making long-term disruption more difficult.

The seizure of virtualine.net represents a coordinated effort to disrupt infrastructure allegedly used to support criminal activity. However, the broader challenge remains: preventing bulletproof hosting providers from rebuilding their networks, changing operational identities, and returning to service after law enforcement action.