The FBI Washington Field Office seized the web domain virtualine.net on October 27, 2026, taking down the public storefront of a hosting company that the U.S. Attorney’s Office for the Eastern District of Virginia calls a “bulletproof” provider for cybercriminals. Prosecutors allege that the company, Virtualine, knowingly hosted a criminal forum and accepted bitcoin payments that were then laundered. No individual has been publicly charged, and everything described below is an allegation.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Court filings, according to the Justice Department, show the operation also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Its operator has publicly rejected the accusation.
A seizure authorized by a court, with no defendant named
The Justice Department’s announcement says the government obtained court authorization to seize virtualine.net. It cites no case number, names no defendant, describes no indictment or complaint, and mentions no sanctions designation. The release identifies First Assistant U.S. Attorney Theophani K. Stamos and FBI Washington Field Office Assistant Director in Charge Darren B. Cox, and lists Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz as the lawyers representing the government. The FBI led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the U.K. National Crime Agency, and the department credited the private firms OverRIPE and Lumen as partners. Nothing in the release says anyone has been arrested, charged or convicted.
The forum prosecutors call Vendor 1
At the center of the allegations is an unnamed forum the release calls “Vendor 1.” Prosecutors say the forum let users post and sell nude or sexually explicit images of minors and adults, and that it offered a hack-for-hire service for obtaining victims’ images without consent. They allege Virtualine kept hosting it after notices from law enforcement in Germany, Canada and Australia, from the National Center for Missing and Exploited Children, and from a victim’s attorney. They further allege the company helped Vendor 1 build a replacement site for uploading and downloading illicit material, which the release says is still online and has drawn at least one abuse complaint.
The advertising is part of the case too. The Justice Department says Virtualine pitched itself on cybercrime forums as a place for “illegal/black hat” activity, excluding only child content and terrorism. The Hacker News reports the government also points to a March 2026 “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and to a June 2025 forum post bragging that Virtualine ignored more abuse complaints than a customer’s last three hosts.
The pitch was priced like ordinary cloud hosting. The Hacker News, citing an Internet Archive capture of the company’s site from early October, lists standard plans from $19.99 a month for one virtual CPU up to $179.99 for 24, and optimized plans reaching $379.99. The same report says the anti-abuse group Spamhaus noted in September 2025 that Virtualine had expanded to a new network, AS209800, routed through the German carrier aurologic GmbH. Chainalysis dates one of the advertising posts to September 2024 on the Exploit.in forum.
Bitcoin from unhosted addresses
The money allegation is narrower than the hosting one. According to the release, Virtualine took payment through unhosted bitcoin addresses, a route that avoided the anti-money-laundering flags a regulated exchange would raise, and then laundered the funds to conceal where they came from.
Blockchain-analysis firm Chainalysis, which supplied intelligence support through the OverRIPE researcher coalition, says on-chain activity tied to the company shows links to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam and phishing addresses. The firm published no bitcoin volume and no count of counterparties, so the scale of the alleged laundering is not public. Chainalysis calls the exposure a compliance signal for businesses that see payments from the labeled addresses.
Seizing a domain versus ending a hosting business
Silent Push, a threat-intelligence company that did not take part in the operation, has tracked the network since February. It says it saw infrastructure move on February 11, 2026 from Railnet LLC (AS214943) to Omegatech (AS202412), with Virtualine Technologies inside Omegatech’s subnets. Omegatech is not fully offline, Silent Push says, but its prefixes now show very low routing visibility. The researchers add that the operator’s open letter, posted within hours of the seizure, said the business could rebrand and resume quickly. The operator’s own account, as reported by The Hacker News, is that it cut ties with Vendor 1 once prohibited material was identified, acts on child-safety cooperation requests within 24 hours, and that customer data is safe.
The history of the sector explains the caution. When the Treasury Department designated the St. Petersburg-based Aeza Group and four named leaders on July 1, 2025, Acting Under Secretary Bradley T. Smith said cybercriminals “continue to rely heavily on BPH service providers like Aeza Group.” Silent Push’s account of the Virtualine seizure recalls that Aeza’s addresses were quickly re-announced under another network number that already held more than 2,100 addresses, and that Dutch authorities took more than 800 servers linked to THE.Hosting in May 2026. A hosting company can obtain a new network number in two to five business days, according to the joint advisory Silent Push cites.
Silent Push offers a blunt caution in the context of the seizure itself: “A lost ASN does not by itself mean the BPH has stopped.” One address it lists, 91.92.240.5, has sat on its bulletproof-hosting feed since October 22, 2025, before and after the move to Omegatech, a reminder that tracked infrastructure can outlive a corporate label.
What happens to Virtualine’s customers, and whether prosecutors file charges against any person behind the company, is left open by the release. The Justice Department says the Vendor 1 replacement site was still hosted by Virtualine when the announcement was made.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
