The FBI has seized virtualine.net, the main domain of Virtualine, a bulletproof hosting service that prosecutors say rented servers to ransomware operators, infostealer crews, phishing and carding outfits, and a forum selling child sexual abuse material. The seizure was announced on October 27, 2026 by the US Attorney’s Office for the Eastern District of Virginia and the FBI Washington Field Office.
Dutch police followed a day later, saying they had seized dozens of physical servers in a data center in the province of Limburg, taking hundreds of virtual servers offline and recovering data on more than 3,000 customers.
A host that sold protection from police
Virtualine also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. According to court records cited by the Justice Department, it advertised directly to criminals on cybercrime forums. In a September 2024 post, it told a prospective customer the service could be used for “all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others) except for child contents and terrorism activities.”
In March 2026, Virtualine began selling what it called an “additional protection plan.” Prosecutors say that after the provider received a law enforcement request, it would move the customer’s infrastructure to “another shell company not affiliated with Virtualine,” then switch the server back on.
Prosecutors allege Virtualine broke even its own stated rule. Court records say it knowingly hosted a criminal forum, identified only as “Vendor 1,” that sold explicit images and videos of minors and adults and promoted a hack-for-hire service used to break into victims’ accounts. Virtualine allegedly ignored notices from law enforcement in Germany, Canada and Australia, the National Center for Missing and Exploited Children and a victim’s attorney, then helped the forum build a new site that it still hosted when the domain was seized.
Following the bitcoin
Virtualine accepted payment through unhosted bitcoin addresses, which let customers pay without their funds being screened by exchange compliance teams. The Justice Department says the provider then laundered those payments to hide where they came from.
Blockchain analytics firms that supported or tracked the case shared what those wallets show:
- Chainalysis, which provided intelligence support to investigators, said Virtualine’s addresses had direct exposure to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam and phishing operations.
- TRM Labs reported that a Russian drug marketplace accounted for about 44% of Virtualine’s direct inflows, a sextortion scheme about 17%, a mixer about 13% and ransomware groups about 5%.
- TRM also said the
StealCinfostealer operation paid Virtualine throughout 2026, and that Virtualine received more illicit-attributed cryptocurrency in 2026 than any other bulletproof host it tracks.
TRM noted that payments show financial relationships with the host but do not, by themselves, prove which attacks ran on its servers.
The Omegatech network and what is still online
Researchers at Silent Push said the action was carried out under the name Operation Omegaline. The firm tracked a February 2026 shift of malicious infrastructure from the bulletproof host Railnet LLC (AS214943) to a newly registered network, Omegatech (AS202412), where it found Virtualine’s infrastructure. The Omegatech network was not fully offline as of October 27, but its address ranges showed very low routing visibility, a sign that much of it may no longer be reachable.
Within hours of the seizure, the operator posted an open letter on a second domain disputing the allegations. The letter said the claims about the service’s customers “deserve a fair investigation” and rejected the child abuse allegations, while also acknowledging the service could “rebrand, build a new website, and carry on.”
No arrests or charges against Virtualine’s operators have been announced. Dutch police said follow-up action against customers is underway, and German police carried out parallel actions aimed at suspects and cryptocurrency seizures.
Who worked the case
The FBI Washington Field Office led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the UK’s National Crime Agency. Private sector partners included OverRIPE, a coalition of researchers focused on malicious hosting, and Lumen.
What defenders should do
Because bulletproof hosts can obtain a new network number within days and move the same address ranges across, blocklists tied to a single ASN go stale fast. Security teams should:
- Review logs for traffic to
AS202412andAS214943and to thevirtualine.netdomain - Refresh ASN and IP blocklists often and watch for new networks that fill with addresses quickly
- Follow the joint CISA guidance on bulletproof hosting providers
The takedown is the latest in a run of actions against cybercrime infrastructure. Recently, Australia’s ASD cut off Amadey malware access to 180,000 infected computers. For background on the stealer economy that hosts like Virtualine support, see our guide to what infostealer malware is.
