### International Operation Targets Cybercrime Enabler The U.S. Department of Justice (DoJ) has made a significant move against the cybercrime ecosystem by seizing the domain of **Virtualine**, a bulletproof hosting provider (BPH). The DoJ's announcement highlighted **Virtualine**'s alleged involvement in a spectrum of illicit activities, from the distribution of child sexual abuse material (CSAM) and nonconsensual intimate visual depictions to sophisticated international money laundering schemes. Visitors attempting to access "virtualine[.]net" are now met with a seizure notice from the **U.S. Federal Bureau of Investigation (FBI)**. This operation was a collaborative effort involving international law enforcement agencies, including the **Hessen State Police** (Germany), the **National Police Corps of the Netherlands**, the **U.K. National Crime Agency**, and private sector entities such as **OverRIPE** and **Lumen Technologies**. ### Virtualine's Modus Operandi Court documents reveal that **Virtualine**, also known by aliases such as **Secury**, **Massgod**, **Spamhouse**, **Lanedo**, and **Omegatech**, actively promoted its services on cybercrime forums. The provider allegedly boasted about its resilience to abuse reports, promising a safe haven for activities like phishing, carding, email spam, and port scanning, with the supposed exceptions of child content and terrorism. Remarkably, **Virtualine** reportedly offered an "additional protection plan," assuring criminals that their infrastructure could be relocated to shell companies to evade law enforcement scrutiny. Despite its public stance against child content, the DoJ claims **Virtualine** knowingly hosted "Vendor 1," a criminal online forum facilitating the sale and exchange of illicit images and videos, including CSAM. ### Persistent Hosting Despite Warnings The DoJ detailed that **Virtualine** continued to host "Vendor 1" even after receiving numerous notifications from law enforcement agencies in Germany, Canada, and Australia, the **National Center for Missing and Exploited Children (NCMEC)** in the U.S., and a victim's attorney. Furthermore, **Virtualine** is accused of collaborating with "Vendor 1" to establish a new platform for uploading and downloading illicit content, which reportedly remains active and hosted by **Virtualine**. ### Financial Infrastructure for Illicit Gains **Virtualine**'s payment system was designed to obscure the origins of funds. The DoJ stated that **Virtualine** accepted **Bitcoin** payments through specific unhosted addresses (**BTC [NO-AML]**), allowing customers to bypass compliance checks typically found at hosted exchanges. This method facilitated the laundering of funds, some directly traceable to various criminal groups. Blockchain intelligence firm **Chainalysis** corroborated this, noting that **Virtualine**'s on-chain footprint showed direct connections to a wide array of cybercrime entities, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam/phishing addresses. ### Operator's Rebuttal and Industry Concerns Following the seizure, an individual claiming to be the operator of **Virtualine** published an open letter on **virtualine.org**, refuting allegations of knowingly hosting CSAM. The operator claimed prompt action on CSAM-related requests and insisted that customer data remained secure. They also stated that upon identifying prohibited material associated with "Vendor 1," the relationship was terminated. However, the **Spamhaus Project** had previously highlighted **Virtualine**'s expansion into new Autonomous System Numbers (ASNs), indicating its persistent efforts to acquire new IPv4 prefixes for internet abuse. Organizations like **Silent Push** have emphasized that losing an ASN does not equate to a BPH ceasing operations, advocating for stricter ASN registration processes to curb the rapid acquisition of new infrastructure by such entities.