AQSh huquqni muhofaza qiluvchi organlari Virtualine, kiberjinoyatchilik forumlarida noqonuniy faoliyatni osonlashtirish uchun reklama qilingan o'q o'tkazmaydigan xosting xizmati asosiy domenini musodara qildi.
Xizmat shuningdek Secury, Massgod, Spamhouse, Lanedo va Omegatech nomlari ostida ham faoliyat yuritgan va mijozlarni huquqiy shikoyatlar, huquqni muhofaza qiluvchi organlar va boshqa rasmiy organlardan keladigan so'rovlardan himoya qilishni va'da qilgan.
AQSh Adliya vazirligi (DOJ) Virtualine "noqonuniy/qora shlyapa faoliyatlari"ni, jumladan fishing, spam yuborish, kartochka firibgarligi va port skanerlashni o'z ichiga olgan xizmatlarni reklama qilganini tasdiqladi.
FBI xizmatning asosiy domeni virtualine[.net]ni musodara qildi. Bu Germaniyaning Polizei Hessen, Niderlandiyaning Politie Midden-Nederland, Buyuk Britaniyaning Milliy Jinoyatchilik agentligi, shuningdek OverRIPE va Lumen xususiy hamkorlari ishtirokidagi tergov natijasida amalga oshirildi.
Musodara banneri Manba: BleepingComputer
Virtualine bolalar kontentiga nisbatan aniq chiziq chizgandek ko'rinsa-da, rasmiylar operator bolalar zo'ravonligini targ'ib qiluvchi onlayn forumni ongli ravishda xost qilgan va huquqni muhofaza qiluvchi organlar, Yo'qolgan va Ekspluatatsiya qilingan Bolalar Milliy Markazi (NCMEC) va jabrlanuvchining advokatidan kelgan takroriy ogohlantirishlarni e'tiborsiz qoldirganini aytishmoqda.
Rasmiylar forumga nisbatan huquqiy bosim kuchayganidan so'ng, Virtualine administratorlar bilan birgalikda yangi saytni tashkil etishda ishlaganini da'vo qilmoqda.
"Virtualine bu yangi veb-saytni hozirgacha xost qiladi va u allaqachon ushbu veb-saytda topilgan bolalarning jinsiy ekspluatatsiya tasvirlari haqida kamida bitta shikoyat olgan," deb aytdi DOJ.
Virtualine administratori Silent Push kiberxavfsizlik kompaniyasi tomonidan qayd etilgan virtualine[.]org yangi veb-saytida e'lon qilingan rasmiylarga ochiq xatda ayblovlarni rad etdi.
Operator xizmatning noqonuniy faoliyati va mijozlari haqidagi da'volar "adolatli tergovni talab qiladi" deb aytgan bo'lsa-da, ular "bolalarning jinsiy ekspluatatsiyasini insoniyatga qarshi jinoyat" deb hisoblashlarini bildirdi.
Kiberjinoyatchilik ekotizimi
Virtualine shuningdek mijozlardan to'g'ridan-to'g'ri Bitcoin to'lovlarini qabul qilgan va kiberjinoyatchilarga boshqa joylarda o'g'irlangan daromadlarni yuvishda yordam bergan.
Huquqni muhofaza qiluvchi organlarga razvedka yordamini taqdim etgan Chainalysis blokcheyn razvedka firmasi Virtualine to'lov manzillarini to'g'ridan-to'g'ri ransomware operatorlari, infostealer infratuzilmasi, rus tilidagi kiberjinoyatchilik forumlari, noqonuniy do'konlar, firibgarliklar va fishing platformalariga bog'ladi.
"Virtualine xost qilinmagan hamyon manzillari orqali to'g'ridan-to'g'ri bitcoin to'lovlarini qabul qildi, bu jinoyatchi mijozlarga o'z mablag'larini xost qilingan birja muvofiqlik dasturlaridan o'tkazmasdan to'lash imkonini berdi," deb ta'kidlaydi Chainalysis.
"Virtualine keyin bu daromadlarni ularning kelib chiqishini yashirish uchun yuvdi," deb qo'shdi blokcheyn kompaniyasi.
Bugun e'lon qilingan hisobotda TRM blokcheyn razvedka firmasi ransomware guruhlari Virtualine moliyaviy oqimlarining 5% ni tashkil etganini, rus narkotik bozori esa taxminan 44% ni tashkil etganini aytdi.
"Katta sekstorsiya sxemasi va mikser ham mablag'larning asosiy manbalari edi," deb aytdi kompaniya.
Virtualine mijozlari manba: TRM
TRM shuningdek Virtualine bu yil StealC infostealeridan to'lovlar olganini, tranzaksiyalar doimiy moliyaviy munosabatni ko'rsatishini aytadi.
Niderlandiya politsiyasining matbuot xabarida Limburgda o'nlab jismoniy serverlar musodara qilingani, yuzlab virtual serverlar oflayn rejimga o'tkazilgani qayd etilgan.
Politie shuningdek tergovchilar 3000 dan ortiq Virtualine mijozlaridan ma'lumotlarni tiklaganini va ularga nisbatan keyingi choralar ko'rilayotganini aytdi.
Niderlandiya rasmiylariga ko'ra, noqonuniy platforma kamida 2022 yildan beri kiberjinoyatchilik operatsiyalarini, jumladan ransomware, botnetlar, infostealerlar, fishing va bolalar zo'ravonligi materiallarini tarqatishni osonlashtirgan.
O'q o'tkazmaydigan xosting provayderi qisman onlayn qolgan bo'lsa-da, tadqiqotchilar uning tarmoq prefikslari hozirda juda past marshrutlash ko'rinishiga ega ekanligini kuzatishdi, bu uning infratuzilmasining katta qismi endi yetib bo'lmasligini ko'rsatadi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaani o'lchaydi.
Hisobotni oling
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.
The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities.
The U.S. Department of Justice (DOJ) confirmed that Virtualine marketed services that permitted “illegal/black hat activities” ranging from phishing, spamming, and carding to port scanning.
The FBI seized the primary domain of the service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.
Seizure banner Source: BleepingComputer
Although Virtualine drew an apparent line at child content, authorities say that the operator knowingly hosted an online forum promoting child abuse material and ignored repeated notices from law enforcement, the National Center for Missing and Exploited Children (NCMEC), and a victim’s attorney.
Authorities allege that after legal pressure against the forum increased, Virtualine worked with the administrators to set up a new site.
"Virtualine hosts this new website to this day, and it has already received at least one abuse complaint about sexually explicit images of children found on that website," the DoJ said.
The administrator of the Virtualine rejected the allegation in an open letter to authorities published on a new website, virtualine[.]org, captured by cybersecurity company Silent Push.
The operator said that while claims about the service's illegal activities and customers "deserve a fair investigation," they regarded "sexual exploitation of children as a crime against humanity."
Cybercrime ecosystem
Virtualine also accepted direct Bitcoin payments from customers, helping cybercriminals launder proceeds stolen elsewhere.
Blockchain intelligence firm Chainalysis, which provided intelligence support to law enforcement, linked Virtualine’s payment addresses directly to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams, and phishing platforms.
“Virtualine accepted direct bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without flagging their funds through hosted exchange compliance programs,” Chainalysis notes.
“Virtualine then laundered those proceeds to conceal their origin,” the blockchain company added.
In a report published today, blockchain intelligence firm TRM said ransomware groups were responsible for 5% of Virtualine’s financial flows, while a Russian drug marketplace made up approximately 44%.
"A large sextortion scheme and a mixer were also major sources of funds," the company said.
Virtualine customers source: TRM
TRM says that Virtualine also received payments from the StealC infostealer this year, with transactions indicating a constant financial relationship.
A press release from the Dutch police notes that dozens of physical servers were seized in Limburg, taking hundreds of virtual servers offline.
Politie also said its investigators recovered data from more than 3,000 Virtualine customers, and follow-up action against them is underway.
According to the authorities in the Netherlands, the illegal platform was facilitating cybercrime operations since at least 2022, including ransomware, botnets, infostealers, phishing, and distribution of child abuse material.
Although the bulletproof hosting provider remains partially online, researchers observed that its network prefixes currently have very low routing visibility, suggesting that much of its infrastructure may no longer be reachable.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report