FBI seizes Virtualine, a hosting provider accused of aiding cybercrime

Who is affected

Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, sold hosting and server services to customers recruited on cybercrime forums. According to court records cited by Recorded Future News↗ (opens in a new tab), its clients included operators of forums trading in child sexual abuse material (CSAM), sellers of nonconsensual intimate images, and hackers-for-hire. The service was used by criminal groups involved in phishing, carding (credit card fraud), email spam and other illegal activities. Law enforcement agencies from Germany, Canada, Australia, the US, and the National Center for Missing and Exploited Children (NCMEC) all reported abuse linked to Virtualine.

What was taken

Prosecutors allege that Virtualine knowingly hosted a forum (identified as Vendor 1) where users sold and distributed explicit images and videos of minors and adults. The forum also advertised account-hacking services. Despite repeated complaints from authorities and victims, Virtualine helped the forum's operators build a new site for uploading and selling illicit content, which it continued to host. The provider also accepted bitcoin payments through a service called "BTC [NO-AML]", designed to avoid anti-money laundering checks. Blockchain analysis linked Virtualine's payment addresses to ransomware operators, information-stealing malware, and other illicit activity (Help Net Security↗ (opens in a new tab)).

How the attack worked

Virtualine openly advertised on cybercrime forums, promising to ignore abuse complaints and law enforcement requests. In June 2025, it boasted about ignoring more abuse than "your last three therapists". In March 2026, it offered an "additional protection plan" for customers worried about police intervention. This plan involved moving a customer's criminal infrastructure to another shell company if law enforcement made an official request, then reactivating the server. Despite claiming to ban child abuse and terrorism, prosecutors say Virtualine did not enforce these rules and continued to support criminal operations.

The response

The FBI, supported by law enforcement from Germany, the Netherlands and the UK, as well as private sector partners OverRIPE and Lumen, led the investigation (Operation Omegaline). On 28 October 2026, the FBI seized the virtualine.net domain, replacing it with a seizure notice. The Justice Department has not yet identified Virtualine's operators or announced criminal charges. Within hours, Virtualine posted an open letter on a new domain (virtualine.org), denying the allegations and claiming customer data was safe. The company said it could rebrand and resume operations quickly. Some parts of its network remain online, but visibility has dropped, suggesting disruption.

Has this happened before?

The seizure follows a series of international actions against bulletproof hosting providers. In 2025, the US, UK and Australia sanctioned Zservers and Aeza Group for allegedly supporting ransomware gangs. Dutch police seized 127 servers from Zservers and 800 from Stark Industries, another provider accused of enabling Russian cyber operations. Despite these actions, threat intelligence firm Intel 471 reports that the market for bulletproof hosting has fragmented, with customers moving to new providers operated by former resellers, rather than disappearing.