U.S. and international authorities seized Virtualine's domain, alleging the bulletproof host supported ransomware, fraud, and CSAM activity.

U.S. and international law enforcement have seized Virtualine’s primary domain, a move authorities say disrupted a bulletproof hosting provider used to support a broad range of cybercrime activity. The action, announced Oct. 27, 2026 by the U.S. Attorney’s Office for the Eastern District of Virginia and the FBI Washington Field Office, targets infrastructure prosecutors say enabled ransomware operators, infostealers, fraud forums and child sexual abuse material distribution.

According to the Justice Department, Virtualine operated under several names, including Secury, Massgod, Spamhouse, Lanedo and Omegatech, and openly marketed hosting services to criminals on forums such as Exploit.in and HackForums. Prosecutors said the provider advertised support for phishing, carding and spam in a September 2024 post, and in June 2025 boasted that it "ignored more abuse than your last three therapists." In March 2026, it began promoting an "additional protection plan" that purportedly would move a customer’s infrastructure to a shell company if law enforcement made a request, according to the government.

The investigation involved the FBI Washington Field Office, Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the U.K.’s National Crime Agency. Chainalysis said it provided intelligence support to international law enforcement through collaboration with OverRIPE, a coalition of independent security researchers and professionals focused on malicious hosting threats. Chainalysis also said it has labeled the relevant cryptocurrency addresses in its product suite.

The Justice Department alleges Virtualine accepted direct bitcoin payments through unhosted wallet addresses and then laundered the proceeds to conceal their origin.

Source link