The seizure of virtualine.net has not ended all of the hosting activity at the center of a U.S. investigation. In an October 27, 2026 announcement, the Justice Department said Virtualine was still hosting a website it helped a customer build for uploading and selling illicit images, despite an abuse complaint involving sexually explicit images of children.
The Justice Department’s announcement describes a court-authorized seizure targeting the hosting provider’s domain. Authorities allege that Virtualine facilitated the advertisement of sexually explicit images of minors, the nonconsensual disclosure of intimate images of adults and minors, and international money laundering.
The continuing website belonged to a customer identified in court records as Vendor 1. According to the department, Virtualine helped that customer create a service where users uploaded illicit material and downloaded content after purchasing it. At least one complaint about sexually explicit images of children had already reached Virtualine concerning that site by the announcement date.
Hosting continued after repeated notices
The department’s allegations also concern an online forum operated by Vendor 1. It offered access to nude, sexually suggestive or sexually explicit images and videos of adults and minors. Alongside those sales, the forum advertised hackers for hire to break into victims’ online accounts and obtain explicit material without consent, authorities said.
Virtualine began receiving reports about sexually explicit images and videos of minors on Vendor 1’s server in January 2026, roughly one month after allocating the customer an IP address. The department identified the senders as police in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and a victim’s attorney. It alleges that Virtualine kept providing hosting despite those notices.
That conduct contradicted a restriction Virtualine advertised, according to the government’s account of court records. In a September 2024 post on Exploit.in, the provider welcomed phishing, payment card fraud, email spam and port scanning, while excluding child sexual abuse material and terrorism-related activity. A June 2025 advertisement on HackForums boasted about ignoring abuse complaints.
Virtualine marketed hosting, servers and domain purchasing under several names: Secury, Massgod, Spamhouse, Lanedo and Omegatech. Its advertised “bulletproof” service included a March 2026 offer called an “additional protection plan.” Following an official law enforcement request, the provider promised to transfer a customer’s criminal infrastructure to a supposedly unaffiliated shell company and reactivate the server, the department said.
Payments form another part of the allegations. Among the options available to customers, including Vendor 1, was BTC [NO-AML]. Authorities described this as direct payment to unhosted bitcoin addresses, intended to avoid funds being flagged as illicit. They allege that some payments were traceable directly to criminal groups and that Virtualine subsequently laundered the funds to obscure their origin.
The FBI Washington Field Office investigated the case with assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, OverRIPE, Lumen and the Justice Department’s Office of International Affairs.
