FBI seizes Virtualine bulletproof hosting domain in multinational operation

What happened

• The FBI seized the primary domain virtualine[.net] following an investigation that involved Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the U.K.'s National Crime Agency, and private partners OverRIPE and Lumen.
• The DOJ said Virtualine marketed services permitting "illegal/black hat activities" including phishing, spamming, carding and port scanning; the service also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech.
• Authorities allege Virtualine knowingly hosted a forum promoting child abuse material, ignored notices from law enforcement, NCMEC and a victim's attorney, and later helped administrators set up a new site that has since drawn at least one abuse complaint.
• The Virtualine administrator rejected the allegations in an open letter published on virtualine[.]org, saying claims about illegal activity and customers deserve a fair investigation while calling sexual exploitation of children a crime against humanity.
• Chainalysis, which provided intelligence support to law enforcement, linked Virtualine's payment addresses to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams and phishing platforms.
• TRM reported that ransomware groups accounted for 5% of Virtualine's financial flows, while a Russian drug marketplace made up approximately 44%; Virtualine also received payments from the StealC infostealer this year.
• Dutch Politie said investigators recovered data from more than 3,000 Virtualine customers and that follow-up action against them is underway; authorities say the platform facilitated cybercrime since at least 2022.

Why it matters

The seizure and customer data recovery give investigators leads against thousands of users of a service allegedly tied to ransomware, infostealers and other cybercrime.

What is unknown

The operator disputes the allegations, and the source does not describe charges, arrests or the status of the seized domain beyond the seizure itself. The 5% and 44% flow figures come from TRM's report and are not independently confirmed here.