The FBI has seized virtualine.net, the domain of a bulletproof hosting provider that laundered money for its criminal customers and kept a forum trading in child sexual abuse material online despite repeated warnings from police and child protection groups.

Virtualine FBI seizure

Seizure notice (Source: US Department of Justice)

The FBI Washington Field Office led the investigation, dubbed Operation Omegaline, with help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector partners OverRIPE and Lumen.

Open for business on hacker forums

Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, sold hosting, servers and domain registrations to customers it recruited on cybercrime forums.

Prosecutors say the service was used to advertise sexually explicit images of minors and to spread intimate images of adults and minors without their consent, and that the company laundered money for its customers.

The provider courted criminals openly. “You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities,” it told a user on the Exploit.in forum in September 2024.

In June 2025, it bragged on HackForums that “Virtualine ignored more abuse than your last three therapists.”

This March, the company started selling an “additional protection plan” to customers worried about the police. After it would “receiv[e] an official request from law enforcement agencies,” Virtualine promised to move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”

Child abuse material stayed online

Despite its own rule on “child contents,” Virtualine knowingly hosted a criminal forum, identified in court records as Vendor 1, where users sell access to explicit images and videos of minors and adults. The forum also advertises hackers for hire who break into victims’ accounts to steal intimate photos and videos.

Starting in January 2026, police in Germany, Canada and Australia, the National Center for Missing and Exploited Children (NCMEC) and a victim’s attorney warned the host about child sexual abuse material on the forum’s server. Virtualine kept the forum online and helped Vendor 1 build a new site for uploading and selling content, a site Virtualine still hosts.

“Virtualine accepted payment through BTC [NO-AML], specific unhosted bitcoin addresses that allowed customers to direct pay without concern their funds would be flagged as illicit,” the Justice Department said.

Blockchain analysis firm Chainalysis, which supported the investigation together with OverRIPE, a coalition of independent security researchers, says Virtualine’s payment addresses have direct links to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops and scam and phishing addresses.

A rebrand away from a comeback

Threat intelligence company Silent Push had been tracking the network since February 11, 2026, when it spotted infrastructure moving from Railnet, a known bulletproof host, to a newly registered network called Omegatech. Virtualine Technologies turned up within that network as well.

Within hours of the seizure, Virtualine posted an open letter on a second domain, virtualine.org, disputing the allegations, and assured followers on Telegram that their data was safe. The letter’s author admitted they “could rebrand, build a new website, and carry on,” and said it might take a day or less.

Parts of Omegatech’s network remain reachable, Silent Push says, though its routing visibility has dropped very low, usually a sign of serious trouble for the operator. The company counted 50 bulletproof hosting providers on its radar that lost their network identifiers (ASNs) in the past 12 months.

A joint advisory published in November 2025 by CISA, the FBI, the UK’s NCSC and other agencies warns that such providers can get a new ASN in two to five business days and move the same IP ranges over to it.