DOJ Seizes Virtualine Domain Over Alleged Criminal Hosting and Laundering
Summary
The DOJ announced the seizure of Virtualine’s domain, alleging the bulletproof host supported criminal services and laundered customer payments. The operator disputes knowingly hosting illegal material and says customer data is safe.
Key points
- The DOJ said Virtualine[.]net was seized in a coordinated operation involving international law enforcement and private-sector partners.
- Court documents allege Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, hosted services linked to criminal activity despite receiving abuse reports.
- The DOJ alleges Virtualine worked with a customer identified as Vendor 1 to create a site for uploading and purchasing illicit content.
- The DOJ alleges Virtualine accepted direct Bitcoin payments through unhosted addresses and further laundered some customer funds.
- Chainalysis said Virtualine’s on-chain activity had links across parts of the cybercrime ecosystem, including ransomware operators and infostealer infrastructure.
- The operator denies knowingly hosting child sexual abuse material, says it acted on cooperation requests, and claims customer data is safe.
Article Details
- Event Type
- Law enforcement domain seizure of Virtualine, a bulletproof hosting provider, over alleged criminal hosting and money laundering.
- Impact
- The U.S. Department of Justice says Virtualine hosted services linked to child sexual abuse material and nonconsensual intimate imagery, and that funds from criminal customers were laundered. The seizure notice now appears on virtualine[.]net. Virtualine’s operator denies knowingly hosting the material and says the service acted on cooperation requests.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | virtualine[.]net | Domain of the bulletproof hosting provider seized by the FBI; the DoJ alleges the provider used its service to host criminal activity. |
Vendors
Countries
AustraliaVendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; and a victim'sCanadacontinued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; andGermanycontinued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the UnitedNetherlandsand private sector entities, including the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.Turkey2025, the Spamhaus Project revealed that Virtualine had expanded their operations to AS209800. "Thanks to Turkey- and U.S.-based IP address brokers with poor customer vetting procedures, Virtualine keeps obtaining newUnited StatesThe U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine.