On October 27 the FBI seized virtualine.net, the storefront of a Russian-speaking bulletproof hosting provider that recruited customers on underground forums, took payment through unhosted Bitcoin addresses, and kept a forum selling access to child sexual abuse material online after police in three countries warned it. The provider is Virtualine Technologies. The operation is called Omegaline. The charging language is unusually blunt.

So was the operator's response, hours later.

What was seized

The FBI's Washington Field Office led the investigation with the US Attorney's Office for the Eastern District of Virginia. Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland and the UK's National Crime Agency took part, alongside the private-sector partners OverRIPE and Lumen, with blockchain analysis from Chainalysis.

What was seized was a domain. Not a datacenter, not a network, not a person. That matters, because everything below follows from it.

What the company sold

Virtualine traded under several names — Secury, Massgod, Spamhouse, Lanedo and Omegatech — and rented hosting, servers and domain registrations to customers it recruited on cybercrime forums. On Exploit.in in September 2024 it advertised: "You can use Virtualine for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others) except for child contents and terrorism activities." In July 2025 it bragged on HackForums that "Virtualine ignored more abuse than your last three therapists." Entry pricing was $0.79 a month.

In March 2026 it began selling an "additional protection plan" to customers worried about police: after "receiving an official request from law enforcement agencies," it promised to move the customer's criminal infrastructure to "another shell company not affiliated with Virtualine, after which the server is reactivated."

The forum that stayed up

Despite its own rule on "child contents," Virtualine knowingly hosted a forum — identified in court records as Vendor 1 — where users sell access to explicit images and videos of minors and adults, and where hackers advertise breaking into victims' accounts to steal intimate footage, according to prosecutors.

From January 2026, police in Germany, Canada and Australia, the National Center for Missing and Exploited Children, and a victim's attorney warned the host about material on the forum's server. Virtualine kept it online and helped Vendor 1 build a new site for uploading and selling content — a site the company still hosts.

The money

Virtualine accepted payment through "BTC [NO-AML]" — specific unhosted Bitcoin addresses that let customers pay directly without their funds being flagged as illicit, per the Justice Department.

TRM Labs, which was tracking the service before the seizure, breaks down the direct inflows: about 44% from a Russian drug marketplace, 17% from a large sextortion scheme, 13% from a mixer, 5% from ransomware groups. Further payments came from the StealC infostealer and from Volhav, a rival bulletproof host.

TRM's sharper finding is about composition rather than size. Virtualine was not among the sector's largest by total inflows — but in 2026 it received more value attributed to illicit activity than any other provider TRM labels. Across the tracked sector, quarterly inflow value in Q3 2026 sat about 4% above Q1 2025 while incoming transfers rose 60%. More payments, similar sums: many small customers rather than a few large ones.

Why the domain is the easy part

TRM states the caveat itself: a domain seizure "disrupts how customers find and access a service. It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure."

Within hours Virtualine posted an open letter on a second domain, virtualine.org, disputing the allegations, and reassured followers on Telegram that their data was safe. The author conceded they could "rebrand, build a new website, and carry on" — and said it might take a day or less.

Silent Push, which has tracked the networks since February 11, 2026, when infrastructure moved from Railnet to a newly registered network called Omegatech, says parts of the Omegatech network remain reachable, though routing visibility has dropped very low — usually a sign of serious trouble. It counts 50 bulletproof hosts that lost their network identifiers (ASNs) in the past 12 months. A November 2025 joint advisory from CISA, the FBI, the UK's NCSC and others notes that such providers can get a new ASN in two to five business days and move the same IP ranges over to it.

What it says about takedowns

The case is a clean illustration of the sector's economics. Reputation is the product, and reputation is cheaper to rebuild in a forum than a supply chain. A host that advertises having "ignored more abuse than your last three therapists" is not selling servers; it is selling the assurance that a seizure will be survivable. The operator confirmed that assurance himself, on the day of the seizure.

What to watch

- Whether the infrastructure follows the domain. Silent Push's routing data and TRM's on-chain addresses remain the only way to check. - Whether customers of the "protection plan" resurface at Volhav or elsewhere. Providers resell to one another; the TRM data already shows one payment between the two. - Whether the CSAM site Virtualine is accused of still hosting actually goes offline. The domain was never the crime.

Sources