On 27 October 2026 the US Attorney’s Office for the Eastern District of Virginia announced the seizure of virtualine.net, the website of a service called Virtualine. DOJ says the site was used for criminal activity, including international money laundering. The release calls Virtualine a “bulletproof” service that offered hosting and server solutions with domain name purchasing options.
Why DOJ Calls Virtualine Bulletproof
Bulletproof hosting is infrastructure that a provider knowingly markets and leases to cybercriminals, in the words of the CISA-led advisory. DOJ calls Virtualine a “bulletproof” service and says it advertised its services to criminals on cybercrime forums.
The seizure of a domain is one kind of law enforcement takedown. The release says a court authorised the seizure and that several countries helped. It does not say that the servers behind the service were switched off.
- Seized site.
- virtualine.net.
- Announced.
- 27 October 2026, by the US Attorney’s Office for the Eastern District of Virginia and the FBI Washington Field Office.
- Names used.
- Virtualine, Secury, Massgod, Spamhouse, Lanedo, Omegatech.
- Helped by.
- Polizei Hessen, Politie Midden-Nederland, the UK National Crime Agency, OverRIPE and Lumen.
How Did Virtualine Sell to Criminals?
DOJ quotes the service’s own sales pitches. In September 2024 Virtualine told a user on the Exploit.in forum: “You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities.” Posts like this are typical of an underground forum, where hosting is sold next to stolen data and tools.
In June 2025, DOJ says, Virtualine told users on HackForums: “Virtualine ignored more abuse than your last three therapists.” The release uses this as evidence of how the service treated complaints.
- September 2024Pitch on Exploit.inVirtualine lists phishing, carding, spam and port scanning as allowed uses.
- June 2025Pitch on HackForumsVirtualine boasts that it ignored more abuse than “your last three therapists”.
- January 2026Abuse notices beginAbout one month after assigning an IP address to a customer forum, Virtualine begins to receive notices about it.
- March 2026Additional protection planVirtualine advertises moving customers to a shell company after a law enforcement request.
- 27 October 2026Domain seizedDOJ and the FBI announce the seizure of virtualine.net.
What Was the Additional Protection Plan?
In March 2026 Virtualine advertised an “additional protection plan”. DOJ says the plan was offered to customers after Virtualine “receiv[ed] an official request from law enforcement agencies.” Under it, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”
In our reading, this is why single-address blocks age badly. If the same customer returns under another company name, a list built on the provider’s name will not follow it. The release itself gives no technical detail on how the moves worked.
What Did Virtualine Do With Abuse Notices?
The release names one customer, a criminal online forum that court records call Vendor 1. DOJ says Virtualine knowingly hosted it, even though Virtualine advertised that it did not allow child content. Notices arrived from law enforcement in Germany, Canada and Australia, from the National Center for Missing and Exploited Children in the United States, and from a victim’s attorney. DOJ says Virtualine kept hosting the forum.
DOJ adds that Virtualine worked with Vendor 1 to build a new website for uploads and downloads, that it hosts this site “to this day” and that the site has already drawn at least one abuse complaint.
How Were Customers Paying?
The site offered several payment options. Virtualine accepted payment through BTC [NO-AML], which DOJ describes as specific unhosted bitcoin addresses. They let customers pay directly without concern that their funds would be flagged as illicit.
DOJ says some of the money can be traced directly to various criminal groups. It says Virtualine received the funds and then laundered them further to hide where they came from.
What Should Defenders Do?
The release publishes no IP ranges, ASNs or other indicators, so there is nothing to paste into a blocklist from it. The joint advisory “Bulletproof Defense”, published on 19 November 2025 by CISA, the FBI and partner agencies, tells internet service providers and network defenders to curate a list of “high confidence” malicious internet resources and to use it for filters. The steps below are our own general guidance.
- Search your DNS, proxy and firewall logs for virtualine.net and for the other names in the release.
- Check which hosting providers your phishing, spam and scanning alerts come from, and group them by network, not by single address.
- Treat hosting reputation as a score that changes. A provider that changes its company name can still host the same customers.
- Feed new indicators from your own incidents back into your threat intelligence process and review the lists on a schedule.
- Answer abuse reports about your own address space quickly, so that you are not the next host in a notice.
A seizure removes one storefront. It does not remove the customers, who can look for another provider. Watch for the same behaviour from a new network.