The U.S. Department of Justice announced the seizure of virtualine.net, the domain of a bulletproof hosting provider that advertised services to phishing, carding and spam operators. The operation involved police agencies in three countries and two private-sector partners.
International Partners Behind the Virtualine Seizure
The Justice Department announced the action on Tuesday. Law enforcement and industry partners included the Hessen State Police in Germany, the Dutch National Police Corps, the UK National Crime Agency, OverRIPE and Lumen Technologies.
Virtualine also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. The source report announced no arrests or charges.
The Justice Department said the service was used for advertising sexually explicit images of minors, non-consensual intimate images and money laundering.
Pricing and Services Sold on Cybercrime Forums
Virtualine advertised on cybercrime forums for phishing, carding, spam and port scanning. Its plans ran from $19.99 to $379.99 per month, a price range that placed it within reach of low-level fraud operators as well as larger groups.
In March, the provider sold an “additional protection plan” under which it would move a customer’s infrastructure to an unaffiliated shell company when law enforcement made requests. The offering was aimed at helping customers stay online after takedown attempts.
Court Documents on Ignored Abuse Notices
Court documents describe a provider that kept hosting problem customers after being warned. Virtualine hosted a forum identified in the filings as “Vendor 1,” which traded illegal content and promoted a hack-for-hire service. The provider assigned the forum an IP address in about December 2025.
Virtualine kept hosting the forum despite notices from law enforcement in Germany, Canada and Australia, from the National Center for Missing and Exploited Children, and from a victim’s attorney.
A History of Boasting About Ignored Reports
The timeline in the filings shows a pattern that began well before the seizure. In June 2025, Virtualine boasted on the HackForums site that it ignored abuse reports. In January 2026 it received notices about illegal content on a customer server. Two months later it launched the protection plan designed to evade law enforcement requests.
Cryptocurrency Trail and Exposure to Ransomware Operators
Virtualine accepted payment through unhosted Bitcoin addresses. Chainalysis says the on-chain footprint of those addresses shows exposure to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam addresses.
That footprint matters because it connects a single hosting brand to several distinct criminal markets. Customers paying through the same wallets leave a record that investigators can follow across categories of crime that are usually tracked separately.
What the Virtualine Takedown Changes for Cybercrime Hosting
Seizing a domain does not by itself dismantle a hosting operation, and the source report did not say whether Virtualine’s servers or operators were affected beyond the domain. The disruption is nonetheless relevant to the multiple cybercrime groups that relied on the provider for infrastructure, because they now face the work of migrating to other hosts.
The action also shows how bulletproof hosting providers are being pursued: through documented evidence that they ignored notices from several governments and a child-protection organization, combined with blockchain analysis of how they were paid. The involvement of OverRIPE and Lumen Technologies alongside police forces indicates that private-sector cooperation is part of the approach.
No charges have been announced against the people behind Virtualine. Whether prosecutors bring cases will determine whether the seizure is a one-time disruption or the start of a broader action against the operators.
The case also shows the limits of the seizure approach. A domain is a single identifier, and a provider that sold relocation to shell companies as a product had already built a plan for losing infrastructure. The Justice Department’s account of the operation, as reported, does not say whether hosted customers were moved, whether servers were taken offline, or whether Virtualine’s operators have set up under a new name. The five other names the provider used suggest rebranding was already part of its practice, so the next indicator of impact will be whether customers who relied on the service reappear elsewhere.
