Skip to content
Hacker Posts

DOJ and EU police seize Virtualine bulletproof host

The FBI seized virtualine[.]net and Dutch police pulled dozens of servers offline in a coordinated takedown of bulletproof host Virtualine, active since 2022.

Published 3 min read
law-enforcementbulletproof-hostingransomwareinfostealer

US and European law enforcement seized infrastructure belonging to Virtualine, a bulletproof hosting service advertised on cybercrime forums. The FBI seized the primary domain virtualine[.]net, and Dutch police took hundreds of virtual servers offline. The US Department of Justice, through the Eastern District of Virginia, announced the action on Tuesday. The operation was first detailed by BleepingComputer and corroborated by CyberScoop and The Hacker News.

What Virtualine was

A bulletproof host — infrastructure sold on the promise that abuse complaints and takedown notices get ignored. DOJ says Virtualine marketed services for "illegal/black hat activities," including phishing, spamming, carding, and port scanning. It also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Standard plans ran $19.99 to $179.99 a month; optimized plans $21.99 to $379.99. Dutch authorities say the platform facilitated cybercrime since at least 2022 — ransomware, botnets, infostealers, phishing, and the distribution of child sexual abuse material.

Who took it down

  • FBI (United States) — domain seizure.
  • Politie (Netherlands) — seized dozens of physical servers in Limburg, pulling hundreds of VMs offline and recovering data on more than 3,000 customers.
  • Hessen State Police (Germany) and the UK National Crime Agency.
  • Private partners OverRIPE and Lumen Technologies; blockchain intelligence from Chainalysis and TRM Labs.

The money trail

Virtualine accepted direct Bitcoin from unhosted wallets — advertised as "BTC [NO-AML]" — so customers could pay without funds being flagged. Chainalysis linked its payment addresses to ransomware operators, infostealer infrastructure, Russian-language forums, illicit shops, and phishing platforms, and said Virtualine "then laundered those proceeds to conceal their origin." TRM Labs attributed roughly 5% of Virtualine's flows to ransomware groups and about 44% to a Russian-language drug marketplace, and reported that the StealC infostealer made payments to Virtualine this year.

What to do today

  1. Hunt for StealC and the named infrastructure. If TRM's StealC linkage touches your telemetry, Virtualine prefixes are a pivot point — review outbound connections and C2 resolution against the seized ranges.
  2. Expect churn, not death. The service is partially online but its prefixes now have very low routing visibility. Bulletproof hosts rebrand; watch for the Secury / Massgod / Omegatech aliases resurfacing under new ASNs.
  3. Re-check retention. If your logs cover 2022 onward, Virtualine-hosted domains in historical phishing or infostealer campaigns are worth a retroactive sweep now that attribution is public.

Context

This is the latest in a steady run of infrastructure-layer takedowns — the enforcement model has shifted from chasing individual operators to seizing the rails cybercrime rents: bulletproof hosts, VPNs marketed for anonymity, and crypto laundering channels. Virtualine's operator denied the allegations in an open letter at virtualine[.]org, calling child exploitation "a crime against humanity" and saying the claims "deserve a fair investigation." No operators have been named or charged in the materials released so far.

Related stories