The FBI seized bulletproof hosting provider Virtualine on October 27, 2026, under Operation Omegaline. The service , which also operated as Secury, Massgod, Spamhouse, Lanedo, and Omegatech , hosted ransomware operators, infostealer malware, sextortion schemes, and CSAM distribution networks while actively ignoring law enforcement notices from agencies in Germany, Canada, Australia, and the U.S. NCMEC. TRM Labs found Virtualine received nearly one-fifth of all illicit-attributed cryptocurrency flowing to bulletproof hosts tracked in 2026. No arrests have been announced and no operator identities have been disclosed.
What Bulletproof Hosting Actually Is
A standard web host terminates your contract if you run illegal services. Their terms of service prohibit it, payment processors enforce it, and abuse complaints from law enforcement lead to takedowns.
Bulletproof hosting (BPH) inverts that model. The selling point isn’t reliability or speed , it’s guaranteed non-cooperation. Bulletproof hosts advertise explicitly that they will not respond to abuse complaints, law enforcement notices, or takedown requests. Their value proposition to criminal customers is persistence: keep your criminal infrastructure online regardless of what anyone says.
Virtualine’s pitch, as posted on HackForums and other criminal forums, was direct. According to the DOJ, it offered its services “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others).” The HackForums post from June 2025 was even blunter. Virtualine boasted it had “ignored more abuse than your last three therapists.”
That branding attracted exactly the kind of customers who needed platforms that wouldn’t disappear under pressure. As we’ve covered in looking at how malware distribution networks operate in practice, criminal operations depend on infrastructure that stays up when defenders are actively trying to take it down. Bulletproof hosting is what provides that continuity.
The Five Names of One Criminal Service
Virtualine didn’t operate under one brand. The DOJ identified five alternate names it used: Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Running multiple storefronts across different forums and domains is standard practice for bulletproof operators ,it allows different customer acquisition channels, complicates attribution, and means that if one name attracts heat, others remain operational.
The service ran on autonomous system numbers AS209800 and AS202412. As of the seizure, AS209800 is still routed through aurologic GmbH, a German hosting provider, which is why TRM Labs noted that “Virtualine was disrupted, but not completely shut down.” Seizing a domain removes the website. The actual servers and their routed connectivity are a different problem.
What Virtualine Was Running and For Whom
TRM Labs tracked Virtualine throughout 2026 as the top bulletproof host by illicit-attributed cryptocurrency inflows , receiving nearly one-fifth of all illicit crypto flowing into tracked BPH providers, outpacing competitors including SecureHost, vpsbg, and Bearhost.
Among the confirmed criminal services running on Virtualine’s infrastructure: DragonForce and Qilin ransomware operators, the StealC infostealer (which we covered in the context of dark web credential theft), sextortion networks, stolen data markets, and hack-for-hire services. The full client list runs longer; the DOJ complaint names specific “Vendors” by number rather than by identity in its current public filings.
The stolen credential market feeding ransomware and infostealer operations relies entirely on infrastructure that won’t disappear when someone files an abuse report. Virtualine was, by TRM’s measure, the market leader in providing that infrastructure this year.
The Additional Protection Plan
One detail in the DOJ filings stands out as particularly deliberate. Virtualine offered an “additional protection plan.” If a customer received a law enforcement notice or subpoena, Virtualine would actively migrate that customer’s infrastructure to a shell company with no obvious connection to the original account.
This wasn’t passive non-compliance. It was an advertised commercial service. Customers paid for a guarantee that if police came looking, the trail would be moved somewhere clean.
The CSAM Element and What Virtualine Did Instead of Helping
The criminal client referred to in court documents as “Vendor 1” ran a service distributing child sexual abuse material. Virtualine publicly claimed it did not host content involving minors. The judicial investigation established the reality was different.
From around January 2026, Virtualine received multiple notices about Vendor 1’s content from law enforcement in Germany, Canada, and Australia, and from the U.S. National Center for Missing and Exploited Children (NCMEC). Those notices described illegal content. The expected response , under any legitimate hosting provider’s terms ,would be to remove the content and terminate the account.
Virtualine instead helped Vendor 1 create new websites to maintain the distribution service.
That specific conduct , receiving child safety reports and responding by helping the offending client relocate rather than by removing the material , is what distinguishes this from a passive failure to act. It was active facilitation.
For anyone who encounters material of this nature online, the Internet Watch Foundation’s reporting portal at iwf.org.uk and NCMEC’s CyberTipline at missingkids.org/gethelpnow/cybertipline are the established routes.
The Money: Unhosted Bitcoin as the Payment Method
Virtualine accepted payment exclusively through unhosted Bitcoin addresses , wallets not held at regulated exchanges that require identity verification. This bypassed the Know Your Customer and anti-money laundering controls that would flag unusual payment patterns at a conventional financial institution.
Funds received from criminal groups were then laundered into the conventional financial system. The AudiA6 cryptocurrency laundering takedown earlier this year documented how ransomware proceeds move through exactly this kind of layering , dark web infrastructure paid in cryptocurrency, funds mixed and moved, proceeds introduced into the legitimate economy.
The financial investigators in this case include Chainalysis, which traced the illicit flows, and TRM Labs, which quantified Virtualine’s share of the broader bulletproof hosting cryptocurrency market.
What the Seizure Means and What It Doesn’t
Seizing virtualine.net replaced the website with a federal notice. It disrupts how new customers find and sign up for the service. It removes the most visible public face of the operation.
What it doesn’t do is remove the servers, kill the existing customer relationships, or arrest the operators. The DOJ has not disclosed who runs Virtualine. No arrests have been announced. The infrastructure continues to route through AS209800 via aurologic GmbH.
This is a common outcome in bulletproof hosting takedowns, and it’s worth being honest about. As we saw with Operation Alice’s seizure of 373,000 dark web sites, removing the visible storefront doesn’t eliminate the underlying operation. Criminal customers typically migrate to alternative providers — several of which remain active in the same market.
What takedowns like this accomplish is to accumulate legal record, gather evidence during seizure, identify customer patterns, and raise the operating cost for bulletproof providers who have to continuously rebuild. The investigation continues.
Frequently Asked Questions
What is Virtualine?
A bulletproof hosting provider that sold hosting services to criminal clients while deliberately ignoring law enforcement requests. It operated under five aliases: Secury, Massgod, Spamhouse, Lanedo, and Omegatech.
When was it seized?
October 27, 2026, under Operation Omegaline, by the FBI and the U.S. Attorney’s Office for the Eastern District of Virginia, with support from Germany, the Netherlands, the UK, and private threat intelligence firms.
What criminal services did it host?
Ransomware operators including DragonForce and Qilin, the StealC infostealer, sextortion networks, stolen data markets, hack-for-hire services, and a CSAM distribution network.
Were any arrests made?
No arrests have been announced. The operators’ identities remain undisclosed in public filings.
Is Virtualine fully shut down?
No. The primary domain was seized but the underlying infrastructure continues to route via aurologic GmbH. TRM Labs noted the service was “disrupted, but not completely shut down.”
How did Virtualine handle law enforcement notices?
Rather than removing illegal content or suspending accounts, Virtualine helped one client — who was the subject of multiple NCMEC and international law enforcement notices — create new websites to continue their operation.