U.S. law enforcement has seized the main domain of Virtualine, a “bulletproof” hosting service that advertised itself on cybercrime forums as a place where customers could run phishing, spam, carding and port scanning without fear of complaints. According to BleepingComputer, which cites the U.S. Department of Justice, the service also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech. The FBI Washington Field Office and the U.S. Attorney’s Office for the Eastern District of Virginia announced the court-authorized seizure of virtualine.net on 27 October, working with police in Germany (Polizei Hessen), the Netherlands (Politie Midden-Nederland) and the UK (National Crime Agency), plus private partners OverRIPE and Lumen.
Bulletproof hosts are the back-office of much cybercrime: they rent servers that deliberately ignore abuse reports and takedown requests, so criminals can run ransomware command servers, phishing kits and stolen-data shops from them. Chainalysis, which supplied intelligence to investigators, links Virtualine’s Bitcoin payment addresses to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams and phishing platforms. Blockchain firm TRM Labs says ransomware groups accounted for about 5% of Virtualine’s financial flows, a Russian drug marketplace about 44%, and that the StealC infostealer made payments to the service this year in a steady pattern. Authorities also accuse Virtualine of knowingly hosting a forum that distributed child sexual abuse material and of ignoring notices from police and the National Center for Missing and Exploited Children.
The Dutch police say dozens of physical servers were seized in Limburg, taking hundreds of virtual servers offline, and that investigators recovered data on more than 3,000 Virtualine customers, with follow-up action under way. Virtualine’s administrator rejected the allegation about child abuse material in an open letter on a second domain, virtualine.org, captured by Silent Push, which also quoted the letter saying the operator could “rebrand, build a new website, and carry on.” Silent Push and BleepingComputer both report that Virtualine’s network prefixes now have very low routing visibility, which suggests much of its infrastructure is no longer reachable, although the service is not fully offline.
Sources
- U.S. Attorney’s Office, Eastern District of Virginia: bulletproof website domain seized
- Chainalysis: International law enforcement seizes Virtualine bulletproof hosting
- TRM Labs: FBI seizes Virtualine domain
- Silent Push: Operation Omegaline, FBI seizes Virtualine
- BleepingComputer: Police seize Virtualine bulletproof service tied to ransomware, cybercrime
- Dutch police (Politie) press release, linked from BleepingComputer; the page returned access-denied to our checks, so the Dutch details above are as reported by BleepingComputer.