The U.S. Department of Justice announced Tuesday it has seized the domain of Virtualine, a bulletproof hosting provider accused of enabling the distribution of child sexual abuse material, nonconsensual intimate images, and international money laundering. The Federal Bureau of Investigation took control of virtualine[.]net as part of a coordinated international operation involving law enforcement agencies from Germany, the Netherlands, and the United Kingdom, along with private sector partners OverRIPE and Lumen Technologies. Visitors to the site now see a seizure notice stating the domain has been confiscated by federal authorities.
Court documents reveal that Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, promoted its services on cybercrime forums for phishing, carding, email spam, and port scanning while claiming to prohibit child content and terrorism. In June 2025, the provider allegedly bragged on HackForums that "Virtualine ignored more abuse than your last three therapists." In March, the service began offering an "additional protection plan" that promised to shift customers' criminal infrastructure to a shell company unrelated to Virtualine when law enforcement made official requests. Standard hosting plans ranged from $19.99 monthly for one virtual CPU, 2GB memory, and 30 GB storage to $179.99 monthly for 24 vCPUs, 64 GB memory, and 130 GB storage, with specialized plans costing up to $379.99 per month.
Despite advertising that it didn't allow child content on its servers, the Justice Department said Virtualine knowingly hosted a criminal forum identified as Vendor 1 that allowed users to post and sell access to sexually explicit images and videos of minors and adults. "Vendor 1 also promotes a hack-for-hire service in which users can pay hackers to access victims' online accounts without their consent and illicitly obtain explicit images and videos," the department stated. About one month after Virtualine assigned an IP address to Vendor 1 in January 2026, the hosting provider began receiving notifications about sexually explicit images and videos of minors on that server. Authorities said Virtualine continued hosting Vendor 1's services despite numerous notices from law enforcement in Germany, Canada, and Australia, the National Center for Missing and Exploited Children, and a victim's attorney. Virtualine allegedly worked closely with Vendor 1 to create a new website for uploading and downloading illicit content, which remains hosted by Virtualine. The provider accepted payment through BTC [NO-AML], specific unhosted bitcoin addresses that let customers pay directly without concern their funds would be flagged as illicit, according to the department.
Blockchain intelligence firm Chainalysis found that Virtualine's use of unhosted wallet addresses allowed criminal customers to bypass compliance checks at hosted exchanges. "Virtualine's on-chain footprint has direct exposure to a broad cross-section of the cybercrime ecosystem, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses," the firm reported. The Spamhaus Project noted in September 2025 that Virtualine had expanded operations to AS209800, obtaining new IPv4 prefixes through Turkey- and U.S.-based IP address brokers with poor customer vetting procedures. Silent Push warned that losing one autonomous system number doesn't stop a bulletproof hosting provider, and that "the speed of acquiring a new ASN is a crucial part of the problem."
Following the seizure, Virtualine's operator published an open letter denying the service knowingly hosted child sexual abuse material and claiming to have acted on CSAM cooperation requests within 24 hours. The individual insisted that when prohibited material associated with Vendor 1 was identified, the relationship with that customer ended, and that "Virtualine has been part of my life for five years." The operator urged others not to cast suspicion on tens of thousands of customers because of one customer's actions. The international enforcement action demonstrates how bulletproof hosting providers that market abuse-tolerance to criminals face coordinated takedowns even when they obtain new infrastructure rapidly. Dismantling services that deliberately shield criminal operations from accountability requires sustained pressure across jurisdictions, not just technical disruption that operators can route around within days.