FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering

The FBI seized the domain of a “bulletproof” hosting provider accused of facilitating a range of cybercrimes, including money laundering and the distribution of child sexual abuse material.

The Justice Department said Tuesday that a court authorized the seizure of virtualine.net — a service operating under names including Secury, Massgod, Spamhouse, Lanedo and Omegatech — which has now been replaced by a splashpage.

So-called “bulletproof” hosting providers are specialized criminal businesses that rent critical infrastructure to customers based on the promise they will ignore abuse complaints and law enforcement requests.

According to court records, Virtualine explicitly advertised on cybercrime forums, offering hosting for “all illegal/black hat activities,” including phishing, carding and spam. Although the provider claimed to prohibit customers involved in terrorism or child abuse material, prosecutors allege it did not enforce those restrictions.

In June 2025, Virtualine boasted on HackForums that it had “ignored more abuse than your last three therapists.”

In January, about a month after allegedly providing an IP address to a forum used to sell sexually explicit images of minors, distribute nonconsensual intimate images and advertise account-hacking services, the company was sent complaints from authorities in Germany, Canada and Australia, as well as the National Center for Missing and Exploited Children and a victim’s attorney.

Instead of terminating services to the forum, Virtualine helped its operators build another site for uploading and downloading illicit content, according to the Justice Department. The site remained online despite complaints related to sexually explicit images of children.

Virtualine accepted bitcoin payments through a service it named “BTC [NO-AML],” referencing anti-money laundering checks. Prosecutors said Virtualine attempted to launder the proceeds to conceal their origin, though some payments were traceable to criminal groups.

The FBI’s Washington Field Office led the investigation, assisted by authorities in Germany, the Netherlands and Britain, along with private sector partners OverRIPE and Lumen. The Justice Department did not identify Virtualine’s operators or announce criminal charges at the time of the domain seizure.

The seizure follows a series of international actions against bulletproof hosting providers, particularly Russia-linked services accused of supporting ransomware gangs.

In February 2025, the U.S., UK and Australia sanctioned Zservers for allegedly supporting the LockBit ransomware gang. Dutch police seized 127 of its servers that same week.

The U.S. Treasury Department sanctioned Russia-based Aeza Group in July 2025 for allegedly hosting the BianLian ransomware gang and information-stealing malware. Researchers also linked the provider to the Doppelgänger disinformation campaign.

In November, the three countries sanctioned Media Land over alleged ties to the LockBit, BlackSuit and Play ransomware groups. U.S. prosecutors had charged three alleged operators in that case, which they said resulted in about $62 million in victim losses.

Dutch authorities arrested two men and seized 800 servers in May during an investigation into infrastructure linked to Stark Industries, an EU-sanctioned provider accused of enabling Russian cyber operations. Investigators said another company took over Stark's infrastructure after sanctions were imposed.

The long-term impact of such crackdowns has been questioned. Threat intelligence firm Intel 471 reported in August that disruptions had driven customers to newer providers operated by former resellers, fragmenting the market rather than eliminating demand.