Dutch, German and FBI authorities seize Virtualine, a host that promised hackers impunity

In a data center in the Dutch province of Limburg, dozens of physical servers were seized. With them, several hundred virtual servers went dark. Dutch police announced the operation on October 28 against Virtualine, a "bulletproof" hosting provider (bulletproof): it promised customers anonymity and said it would ignore complaints and law enforcement requests alike.

The action was coordinated. According to Dutch police, German police and the FBI moved at the same time against suspects and seized cryptocurrency. The FBI took control of the main domain, virtualine.net. According to BleepingComputer, Hesse police, the UK's National Crime Agency (NCA) and private partners also took part. No arrests have been announced.

Who was hosted on Virtualine?

According to Dutch police, since at least 2022 the platform was used for ransomware, networks of hacked machines (botnets), password-stealing malware, phishing campaigns and the distribution of child sexual abuse material. According to BleepingComputer, the U.S. Department of Justice says it advertised its services for "illegal" activities. It also operated under other names, including Secury, Massgod and Omegatech.

The money shows how big that role was. The service accepted direct bitcoin payments. Chainalysis, which assisted investigators, links its payment addresses to ransomware operators and data-theft tools. Another analytics firm, TRM Labs, attributes about 5% of the funds received to ransomware groups. According to TRM, about 44% of the flows came from a Russian drug marketplace. TRM also found payments from the StealC password stealer.

U.S. authorities also accuse the operator of knowingly hosting a child abuse forum despite repeated reports. In an open letter cited by BleepingComputer, the operator disputes this and says the accusations "deserve a fair investigation."

After the host, its customers

The most important point may lie elsewhere. Dutch police say they hold data on more than 3,000 customers who used these servers for criminal purposes. They announce follow-up action against them.

For businesses, the seizure has a more immediate effect: hundreds of virtual servers hosted at Virtualine were taken offline. According to BleepingComputer, the service remains partly online, but its address blocks are almost invisible on the internet, which suggests that much of its infrastructure may no longer be reachable.

The question is how long its customers will take to find a new host. The Netherlands, for its part, is taking criminal and administrative measures against "bulletproof" hosting providers, announced by the Minister of Justice in a letter in July.