Most of what defenders see of cybercrime is the end of the chain: the phishing email, the stolen session cookie, the ransom note. Behind all of it sits rented infrastructure, meaning servers that host phishing kits, run malware command-and-control panels and keep criminal forums online. On Oct. 27, US and European law enforcement went after one of those landlords directly.

The US Attorney's Office for the Eastern District of Virginia (EDVA) and the FBI's Washington Field Office announced the court-authorized seizure of virtualine.net, the main domain of a hosting provider known as Virtualine. According to the Justice Department, the same service also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

What Is a 'Bulletproof' Host?

An ordinary hosting company takes a server down when it gets a credible abuse complaint or a legal request. A bulletproof host sells the opposite. It promises to ignore those complaints, delay takedowns and protect customers from law enforcement. That makes it the obvious place to put things that would get thrown off a mainstream cloud provider within hours.

Prosecutors say Virtualine was open about this. According to the DOJ, in September 2024 it told a user on the Russian-language cybercrime forum Exploit.in: "You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities." The DOJ also says that in March 2026 Virtualine advertised an "additional protection plan" which, after an official request from law enforcement, would move a customer's criminal infrastructure to a shell company unaffiliated with Virtualine before the server was reactivated.

The pricing looked like ordinary VPS pricing. The Hacker News, citing Internet Archive snapshots, reports standard plans ranging from $19.99 per month for 1 vCPU and 2GB of RAM up to $179.99 per month for 24 vCPUs and 64GB.

The Charges Versus the Cybercrime Angle

The government's case does not focus on ransomware. EDVA's announcement describes the activity as the advertisement of sexually explicit images of minors, intentional disclosure of nonconsensual intimate images, and international money laundering. Prosecutors say Virtualine knowingly hosted a criminal forum, which court papers call only "Vendor 1." The DOJ says it kept hosting that forum despite notices from law enforcement in Germany, Canada and Australia, from the National Center for Missing & Exploited Children (NCMEC) and from a victim's attorney.

The cybercrime link comes mainly from blockchain analytics firms. Chainalysis says that, according to the government, Virtualine hosted infrastructure tied to ransomware operators, infostealers, carding and credential-theft forums, scams and child sexual abuse material (CSAM). Chainalysis also says the service accepted direct bitcoin payments from unhosted wallets, meaning wallets the user controls rather than an exchange account, and that, per the Justice Department, the proceeds were laundered.

TRM's analysis, reported by BleepingComputer, puts numbers on the customer base. Ransomware groups accounted for about 5% of Virtualine's financial flows. A Russian drug marketplace accounted for roughly 44%. TRM also said Virtualine received payments from the StealC infostealer this year. StealC is malware that harvests saved passwords, browser cookies and other credentials from infected machines. Taken together, the figures suggest a general-purpose criminal host whose ransomware business was real but small, not a ransomware-specific operation.

Who Took Part

The operation was international. Per The Hacker News, the seizure banner on the domain credits the FBI, Hessen State Police, the Dutch National Police, the UK's National Crime Agency, OverRIPE and Lumen Technologies. The Justice Department says the FBI investigated with significant assistance from Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the UK's National Crime Agency, and private sector partners OverRIPE and Lumen. Chainalysis says that, together with OverRIPE, it provided intelligence support to law enforcement.

The domain seizure got the headlines, but the physical action happened in the Netherlands. BleepingComputer reports that Dutch police seized dozens of physical servers in Limburg, which took hundreds of virtual servers offline, and recovered data on more than 3,000 customers. According to the Dutch authorities, as relayed by BleepingComputer, the platform had been facilitating cybercrime since at least 2022.

The Operator's Response

Virtualine's operator has pushed back. In an open letter published on virtualine[.]org and captured by the security firm Silent Push, the operator rejected the allegation, according to BleepingComputer, and The Hacker News reports the operator denied knowingly hosting CSAM and said the relationship with the "Vendor 1" customer was ended once prohibited material was identified. That denial comes from the operator alone and has not been tested in court. The DOJ's allegations are also only allegations at this stage. The Hacker News reports that as of Oct. 29, virtualine[.]org and the operator's Telegram channel were no longer accessible.

BleepingComputer also notes that the provider remains partially online, although researchers observed that its network prefixes have very low routing visibility, suggesting much of its infrastructure may no longer be reachable. Seizing a domain cuts off a storefront and a brand. It does not necessarily reach every server, reseller or alias. With five trading names listed, a reappearance under another one would not be surprising.

What It Means for Defenders

This takedown has no patch, CVE or fixed version. Its value for most organizations is visibility. A seizure like this tends to cause a short-term disruption to the criminals who rented the space and a slower migration to new infrastructure. Some practical steps:

  • Search your logs for the brand names. Check DNS, proxy and firewall logs for traffic to virtualine.net, virtualine.org and the other names the service used (Secury, Massgod, Spamhouse, Lanedo, Omegatech). An endpoint on your network talking to a bulletproof host is worth investigating even if nothing has alerted.
  • Treat the StealC link as a credential problem. TRM reported StealC payments flowing to this host. If any of your endpoints have had an infostealer infection this year, assume saved browser passwords, session cookies and VPN or SaaS tokens from those machines were taken. Rotate them and revoke active sessions, because a stolen cookie can get around MFA until the session expires.
  • Don't expect a lasting drop in phishing or C2. Seizures of this kind rarely end the underlying activity. Some phishing domains and malware panels may go dark for a while. Plan for them to come back on new IP space.
  • Watch threat-intel feeds for fresh indicators. Records on 3,000+ customers are now with Dutch police, who say follow-up action is underway, so advisories, indicator releases and arrests are plausible. Make sure your blocklists and SIEM ingest those updates when they appear.
  • For CMMC and federal contractors: infostealers and rented criminal hosting are part of how credentials get stolen and abused. Use this case to confirm that outbound traffic from systems handling CUI is monitored and limited to known destinations, rather than allowed to reach any VPS on the internet.

The broader point is that ransomware and infostealer crews depend on cheap hosting that ignores abuse complaints. Chainalysis calls bulletproof providers foundational infrastructure that lets ransomware, infostealers and fraud scale. Taking one out raises criminals' costs somewhat. It doesn't stop them, but it is a part of the attack chain that defenders seldom see disrupted.

Sources