The FBI has seized the web domain of Virtualine, a hosting service that US prosecutors say sold “bulletproof” servers to cybercriminals and ignored complaints about what its customers did with them. The US Attorney’s Office for the Eastern District of Virginia announced on 27 October that virtualine.net had been taken under a court-authorised seizure warrant, in an operation with police in Germany and the Netherlands.
A day later, the Dutch police said that the cybercrime team of its Midden-Nederland unit had seized dozens of physical servers at a datacentre in Limburg and taken hundreds of virtual servers offline. The Dutch statement does not name the company, but it describes a bulletproof hoster targeted in step with the FBI and German police, and the Justice Department lists Politie Midden-Nederland as a partner in the Virtualine case. Dutch police say they now hold data on more than 3,000 customers and are taking follow-up action against those users.
In brief
- The FBI seized virtualine.net, and Dutch police took dozens of physical and hundreds of virtual servers offline.
- Prosecutors allege the host advertised that it would ignore abuse reports, including notices about a site linked to child sexual abuse material.
- No arrests or charges have been announced; Dutch police hold data on more than 3,000 customers.
What prosecutors say Virtualine sold
Bulletproof hosting is the trade name for servers rented to people who expect the host to ignore abuse reports and police requests. According to the Justice Department, Virtualine, which also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech, marketed itself on that basis. The release quotes a September 2024 advertisement on the Exploit.in forum: “You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities.” A June 2025 post on HackForums, also quoted, boasted that “Virtualine ignored more abuse than your last three therapists.”
Prosecutors say that in March 2026 Virtualine offered an “additional protection plan”. When abuse reports arrived, customer infrastructure would be moved to “another shell company not affiliated with Virtualine, after which the server is reactivated.” Customers could also pay to unhosted bitcoin addresses, advertised as “BTC [NO-AML]”, which the Justice Department says let them pay without their funds being flagged as illicit. It alleges the proceeds were then laundered.
The most serious allegation concerns a customer the release calls “Vendor 1”. Prosecutors describe it as a criminal forum and say Virtualine knowingly kept hosting it after notices about child sexual abuse material on the server began arriving in January 2026. The notices came from law enforcement in Germany, Canada and Australia, from the US National Center for Missing & Exploited Children (NCMEC) and from a victim’s lawyer. The Justice Department also alleges that Virtualine helped the customer build a new site, and says Virtualine still hosts it.
The Dutch police say the hoster had been linked since 2022 to ransomware, botnets, infostealers, phishing and the distribution of child sexual abuse material. They say it promised customers full anonymity and suggested it would ignore complaints, and that the company is suspected of complicity in facilitating cybercrime.
No arrests or charges have been announced. The US release covers the domain seizure. The Dutch statement says the FBI and German police acted against suspects, seized cryptocurrency and took infrastructure offline at the same time, without giving details.
Four police forces and three private firms
The FBI’s Washington Field Office investigated the case with what the Justice Department calls significant assistance from Polizei Hessen in Germany, Politie Midden-Nederland, the UK’s National Crime Agency and two private companies, OverRIPE and Lumen. The department’s Office of International Affairs also helped. Blockchain analysis firm Chainalysis said it gave intelligence support alongside OverRIPE.
Chainalysis says Virtualine’s “on-chain footprint has direct exposure to a broad cross-section of the cybercrime ecosystem, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses.” It says it has labelled the addresses in its products, so that exchanges and other compliance teams can see when funds touch them. The approach mirrors other recent US cases, from the Brooklyn takedown of 112 scam servers to the Madagascar NFT scam charges, where tracing payments sat alongside seizing infrastructure.
The operator disputes the child-protection allegation
The operator has published an open letter on a separate domain, virtualine.org, according to The Hacker News. The letter denies knowingly hosting child sexual abuse material and says the service acted on such reports within 24 hours. The Hacker News quotes it as saying: “When we identified prohibited material associated with the customer described as ‘Vendor 1,’ we ended our relationship with that customer.” A post on Telegram said customer data was safe, the outlet reports. None of these claims has been tested in court. Citing Internet Archive copies, The Hacker News says Virtualine’s standard plans cost $19.99 to $179.99 a month.
Threat intelligence firm Silent Push, which says it was not part of the operation, reports that the Omegatech network was “not fully offline yet” when it published, though barely visible in internet routing. It also quotes the letter’s author: “I could rebrand, build a new website, and carry on… Perhaps it would take a day, perhaps even less.”
Why the customer list matters more than the domain
That boast is the best argument for looking past the seizure banner. Domains are cheap, and Silent Push counts about 50 bulletproof hosts that lost their network registrations in the past 12 months, yet the business keeps coming back. A new name on a new domain is a day’s work, by the operator’s own account.
Servers and records are harder to replace. Dutch police say they have data on more than 3,000 customers and are already acting against them. For a service that sold anonymity, that is the costly part: a list of who rented machines for phishing, malware and ransomware, matched to physical hardware now in police hands. If the follow-up produces names, the takedown becomes a source of leads on the groups that used Virtualine, not just a blow to one host.
The payment trail works the same way. Unhosted bitcoin addresses were sold as a way past exchange checks. Once Chainalysis labels them, any customer who moves those coins through a regulated exchange risks being flagged.
The child-protection side tests something else. Prosecutors say notices came from four countries, NCMEC and a victim’s lawyer over several months. Treating a host that ignores such notices as a suspected accomplice, as the Dutch statement does, is a stronger stance than treating it as a careless landlord.
The Netherlands has been moving in that direction. The Dutch release points to renewed industry codes on abuse handling and takedowns, and Silent Push notes that Dutch fiscal investigators seized more than 800 servers from another host, THE.Hosting, in May 2026. Nine agencies, including the FBI, CISA and the UK’s National Cyber Security Centre, published joint guidance on bulletproof hosting in November 2025, according to Silent Push. It is the same pattern of joint work seen in the SafePay ransomware advisory.
What has not been disclosed
No one has been named as the operator. Neither police force has said how many of the 3,000 customers are outside the Netherlands, what the German side seized, or whether Vendor 1’s newer site is offline. Those answers will show whether Virtualine has been shut or, as its operator suggests, merely moved.
Sources
- US Attorney’s Office, Eastern District of Virginia, “‘Bulletproof’ website domain seized in international law enforcement operation”, 27 October 2026
- Politie, “Internationale actie tegen bulletproof hoster”, 28 October 2026
- Chainalysis, “International Law Enforcement Seizes Virtualine Bulletproof Hosting”, 27 October 2026
- The Hacker News, “FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering”, 28 October 2026
- Silent Push, “Operation Omegaline: FBI Seizes Virtualine”, 27 October 2026
Related stories
- Brooklyn DA and FBI Disrupt 112 Servers and 241 Domains Behind a Crypto Scam Targeting Russian Speakers
- US Charges Six Over Madagascar NFT Scam as Crypto Restraints Top $1bn
- SafePay Ransomware Has Hit at Least 600 Victims, FBI, CISA and UK Police Warn
- Microsoft Disrupts Three Chinese-Language Phishing Services It Links to More Than One Billion Scam Messages
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
