Virtualine domain seized, but the Justice Department says the bulletproof host still serves a flagged site

A domain seized, and a site the release says is still hosted

The Justice Department's own announcement contains the limit of its action. On Tuesday 27 October 2026 the US Attorney's Office for the Eastern District of Virginia and the FBI Washington Field Office announced the seizure of virtualine.net, the website of a hosting service the release calls "bulletproof". Four paragraphs later the same release says that Virtualine built a new website for the client it calls Vendor 1, and that "Virtualine hosts this new website to this day". The release says the abuse notices about Vendor 1 began in January 2026. From the end of January to 27 October is 269 days, and from 1 January it is 299 (derived). So for at least 269 days, by the release's own account, the provider kept serving a client that police in three countries, the US National Center for Missing and Exploited Children and a victim's lawyer had reported.

This briefing reads the primary record, not the coverage of it. The release was read in full through the Justice Department's own press release interface, because the web page answered an automated request with a browser check that was not bypassed. The TRM Labs post that supplied the "almost one fifth" figure was read in full, with its four charts. The domain's registry record was read directly. Reading ran from 11:19 to 11:35 GMT on Thursday 29 October 2026.

What the record does not establish is as important as what it does. The release describes a seizure of one domain under a court order. It names no person, announces no arrest or charge, and states no seizure of servers, network ranges, other domains or money. It links no court document, so the warrant and any affidavit were not read. Every crime in it is an allegation. And the ransomware connection that leads several reports does not appear in the release at all: it comes from blockchain analytics firms, and it describes who paid, not what ran on the servers.

Stated and not stated: the release, line by line

The release is about 600 words long. It alleges three things: the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering "designed to conceal and promote criminal conduct". The table sets what it states against what it leaves out. "Not stated" means not found in the release; it does not mean the fact does not exist in a sealed filing.

One allegation needs stating plainly, once. The release says Virtualine knowingly hosted Vendor 1, a forum that it says sold access to sexually explicit images and videos of minors and adults, and that Virtualine kept hosting it after notices from law enforcement in Germany, Canada and Australia, from the National Center for Missing and Exploited Children (NCMEC) in the United States and from a victim's attorney. This briefing gives no further detail.

What the seizure reached: the registry record

A domain seizure is a change to a registry record, and the record can be read. At 11:24 GMT on 29 October the .net registry's public record for virtualine.net listed two name servers, ns1.fbi.seized.gov and ns2.fbi.seized.gov, three server side locks (delete, transfer and update prohibited), and an update time of 27 October 2026 at 11:32:44 UTC. The release was created in the Justice Department's system at 14:30 Eastern time the same day, which is 18:30 UTC: 6 hours 57 minutes after the registry update (derived). The update time is the last change to the record, which is consistent with the seizure but is not itself proof of when the court order was served.

The same record says the domain was created on 20 June 2023, which is 1,225 days before the seizure (derived). TRM Labs says Virtualine joined the Exploit forum on 28 August 2024 and "claims to have operated since 2019". The domain is therefore younger than the service's own claimed history. Whether earlier domains existed, and whether any of the five other names has a domain of its own, is not stated by any source read.

Zoom

TRM Labs, which tracked the provider's payments, puts the limit in one line: a domain seizure "does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure". That is the right reading, and the release supports it more strongly than TRM does, because the release says one customer's new site is still hosted. Compare an earlier case on this site, where the Integrity Tech seizure came with a public affidavit that could be read line by line. Here no court document is linked.

Friendly names for unfriendly services

Virtualine's own labels, as the release quotes them, are the clearest case on this site in some time of a name doing the work of a promise. "Bulletproof" is a sales word for ignoring legal process. CISA and eight partner agencies define a bulletproof provider as one that "knowingly and intentionally markets and leases their infrastructure to cybercriminals" and say the label rests on not engaging "in good faith with legal processes".

The protection plan matters most to defenders. It means the provider advertised, seven months before the seizure, a routine for moving a customer's servers to a different company name when police asked. From the end of March to 27 October is 210 days (derived). The release does not say whether the plan was used after the seizure. A block list built on the name Virtualine would miss anything the plan moved.

The "one fifth" figure, and the denominator TRM does not print

The figure that travelled comes from TRM Labs. Its chart of the top five bulletproof hosting providers by illicit attributed inflow value for 2026 to date gives Virtualine 19.8 per cent, ahead of SecureHost at 15.2, vpsbg at 13.6, F0XYF0X BPH at 12.0 and Gerry at 11.0, with all other providers at 28.4. The six bars sum to 100.0 (derived). TRM says Virtualine was not among the largest providers by total inflows but received the most illicit attributed value. TRM sells blockchain investigation and compliance tools and says a graph of the Virtualine cluster is available with a TRM licence; its figures are a vendor's analysis, not a court finding.

Zoom

Nowhere in the post is there a dollar figure for Virtualine's total, its illicit attributed total, or the sector's. A share without its base cannot be weighed. The post does print dollar labels on a counterparty graph, and set beside its category chart they suggest the base. The graph shows a drug vendor sending Virtualine $42.1K and the sextortion marketplace TRM labels "Vendor 1" sending $16K. The category chart gives drug and darknet marketplaces 43.7 per cent and the sextortion scheme 16.6 per cent. Dividing each dollar label by its share gives about $96,300 and $96,400; the infostealer's $1.94K at 2.0 per cent gives about $97,000 (all derived).

Three independent pairs landing within one per cent of each other suggest that TRM's percentages rest on roughly 96,000 US dollars of attributed direct payments. That is an inference, labelled as one: it assumes each graph edge is the whole of its category, and the graph does not state its time window. If it holds, the shares that led the coverage describe tens of thousands of dollars, not millions. The same graph shows $260.6K flowing from Virtualine to an "International Exchange 1", about 2.7 times that attributed base (derived). Where the rest of that money came from is not stated.

Zoom

Two details of TRM's post are worth a reader's caution. The category chart is titled "all time", but CyberScoop reported the drug marketplace share as payments "so far this year"; the chart, not the report, is the source. And the post as read on 29 October carries a note beside its top five chart that reads like an unresolved editing instruction: forum reports describe F0XYF0X as banned after an alleged exit scam, and the note ends "Confirm the source before publication". The counterparty graph also labels two separate nodes "Ransomware Group 2". None of this makes the analysis wrong; it means the published version is not final copy.

Zoom

Chainalysis, which also sells blockchain investigation tools and says it has labelled the Virtualine addresses in its products, published its own post. It says it provided intelligence support with OverRIPE. The Justice Department release names OverRIPE and Lumen as private sector partners; it does not name Chainalysis or TRM.

Who said ransomware

CyberScoop, in its report dated 28 October, wrote that cybercriminals used Virtualine for a large scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, and attributed that list to the Justice Department. The release read here does not contain the words ransomware, data theft or malware. Chainalysis likewise says the service hosted infrastructure tied to ransomware operators and infostealers "according to the government". No government document read for this briefing says so. A sealed affidavit might; none is public.

The ransomware link on the record is TRM's, and it is a payment link. TRM says ransomware groups accounted for about 5 per cent of Virtualine's direct inflows (4.8 per cent on its chart). It names Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin as "direct payers across the sector", which is the sector of bulletproof hosts it tracks, and separately says Virtualine's counterparties included "five ransomware groups". CyberScoop reported that those five named groups "all paid the site's operators, according to TRM". TRM's text does not say that in those words. TRM is also explicit that payments "do not, by themselves, identify which attacks or services ran on its infrastructure".

Zoom

The timeline the record supports

Who took part, as the record names them

The release credits the FBI Washington Field Office with the investigation, "with significant assistance from" Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland and the UK's National Crime Agency, and from "private sector partners OverRIPE and Lumen". The Justice Department's Office of International Affairs also assisted. The National Crime Agency's news page, read at about 11:25 GMT on 29 October, carried no statement on the case. No partner's statement was found that says what it did. Unlike the KillSec takedown, where servers and data were seized, this release describes only the domain.

What to do, in order

Technical details

The primaries publish few artifacts. The release prints one domain, five alternative names and one payment label. TRM and Chainalysis say they have labelled Virtualine's bitcoin addresses but print none. No source read publishes an IP address, range, network number, hash or file name for Virtualine. Nothing below is invented to fill that gap. Domains are defanged.

The identifiers as the release prints them. Use the domain for log searches. The other names are names, not domains: the release gives no domain for any of them.

Seized domain:      virtualine[.]net
Also known as:      Secury, Massgod, Spamhouse, Lanedo, Omegatech
Payment option:     BTC [NO-AML]  ("specific unhosted bitcoin addresses")
Hosted client:      "Vendor 1" (identified in court records; not named)

The registry record for the domain, read by this site. It shows the seizure name servers and the server side locks that stop the domain being moved or changed.

Domain Name: VIRTUALINE.NET
Updated Date: 2026-10-27T11:32:44Z
Creation Date: 2023-06-20T08:46:17Z
Domain Status: serverDeleteProhibited
Domain Status: serverTransferProhibited
Domain Status: serverUpdateProhibited
Name Server: NS1.FBI.SEIZED.GOV
Name Server: NS2.FBI.SEIZED.GOV

A check any defender can repeat to confirm the seizure is still in place. This command is this site's, not a primary's.

$ dig +short NS virtualine.net
ns1.fbi.seized.gov.
ns2.fbi.seized.gov.

The advertising text the release quotes, useful to analysts who watch forums for the provider or a successor. Quoted exactly, with the release's own bracketed correction.

Exploit.in, September 2024:
"You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding,
 email spam, port scanning and all others) except for child contents and terrorism activities."

March 2026, the "additional protection plan": the customer's infrastructure moves to
"another shell company not affiliated with Virtualine, after which the server is reactivated."

HackForums, June 2025:
"Virtualine ignored more abuse than your last three therapists."

The lookup pattern CISA's guidance gives for checking a network number against ThreatFox, once a primary publishes one for this provider.

https://threatfox.abuse.ch/asn/[ASN #]

The question the release leaves open

The seizure changed a registry record and took down a storefront. The release itself says the provider still hosts the new Vendor 1 website, the one that has already drawn an abuse complaint. TRM Labs' global head of policy put it as "Seizing a domain matters, but the blockchain record doesn't disappear with it", and the same is true of the servers. So the question for the Justice Department and its partners is direct: if Virtualine hosts that site "to this day", on whose network does it sit, and when will the address ranges be published so that the rest of the internet can stop carrying it?

Key facts