Law enforcement seizes Virtualine domain in cybercrime probe

U.S. and international law enforcement have seized Virtualine’s primary domain, a move authorities say disrupted a bulletproof hosting provider used to support a broad range of cybercrime activity. The action, announced Oct. 27, 2026 by the U.S. Attorney’s Office for the Eastern District of Virginia and the FBI Washington Field Office, targets infrastructure prosecutors say enabled ransomware operators, infostealers, fraud forums and child sexual abuse material distribution.

Evidence and context

According to the Justice Department, Virtualine operated under several names, including Secury, Massgod, Spamhouse, Lanedo and Omegatech, and openly marketed hosting services to criminals on forums such as Exploit.in and HackForums. Prosecutors said the provider advertised support for phishing, carding and spam in a September 2024 post, and in June 2025 boasted that it "ignored more abuse than your last three therapists." In March 2026, it began promoting an "additional protection plan" that purportedly would move a customer’s infrastructure to a shell company if law enforcement made a request, according to the government.

The investigation involved the FBI Washington Field Office, Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the U.K.’s National Crime Agency. Chainalysis said it provided intelligence support to international law enforcement through collaboration with OverRIPE, a coalition of independent security researchers and professionals focused on malicious hosting threats. Chainalysis also said it has labeled the relevant cryptocurrency addresses in its product suite.

The Justice Department alleges Virtualine accepted direct bitcoin payments through unhosted wallet addresses and then laundered the proceeds to conceal their origin. In the Chainalysis account, the hosting provider’s on-chain footprint had direct exposure to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam and phishing addresses. Those claims are attributed to the government and Chainalysis, and the source material does not provide independent verification of all alleged customer activity.

Prosecutors also said Virtualine knowingly hosted a criminal forum that sold access to sexually suggestive and sexually explicit images and videos involving minors and adults, and promoted a hack-for-hire service to obtain intimate content from victims’ accounts. The background material notes that these are attributed allegations, not findings of guilt. The same material also cautions that a domain seizure should not be read as a verified shutdown of all associated infrastructure; Silent Push reported that Omegatech remained partly online and that Virtualine published a letter disputing the allegations.

Bulletproof hosting refers to web and server hosting that deliberately ignores abuse complaints, DMCA notices and law enforcement requests. In practice, that makes such providers infrastructure enablers rather than necessarily the operators of every criminal campaign they host. The case underscores how a single hosting service can support ransomware, credential theft, fraud and illicit marketplaces while using cryptocurrency as a settlement layer.