FBI Seizes Virtualine Domain as Pressure on Bulletproof Hosting Mounts
Summary
The FBI seized virtualine[.]net under Operation Omegaline, while Virtualine disputed allegations. Silent Push says bulletproof hosts can quickly shift to new ASNs and recommends monitoring hosting infrastructure, ASN changes and sanctions lists.
Key points
- The FBI seized virtualine[.]net on October 27, 2026, under Operation Omegaline, with international law-enforcement and private-sector partners involved.
- Silent Push analysts detected a February shift from Railnet (AS214943) to the newly registered Omegatech (AS202412) and identified Virtualine Technologies within Omegatech subnets.
- Virtualine disputed the allegations in an open letter on virtualine[.]org; its Telegram channel claimed that data was safe.
- Omegatech was not fully offline after the seizure, though its network prefixes showed very low routing visibility, according to Silent Push.
- Silent Push says 50 bulletproof hosting providers it tracks lost their ASNs over the prior 12 months; an ASN disappearing can have multiple causes and does not by itself mean a provider has stopped operating.
- A joint advisory says providers can obtain a new ASN in two to five business days and move existing IP ranges, making monitoring for rapid ASN growth and refreshing blocklists important.
Article Details
- Event Type
- Law-enforcement seizure and disruption of bulletproof-hosting infrastructure
- Impact
- The FBI seized virtualine[.]net under Operation Omegaline. Omegatech’s routing visibility fell sharply, but the article says it was not fully offline; Virtualine disputed the allegations. The article also warns that BPH providers can resume operations by moving infrastructure to new ASNs or shell companies.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | anonrdp[.]com | Domain run by the BPH provider AnonRDP; its SPF record shared four IP addresses with ghostynetworks[.]com. |
| DOMAIN | ghostynetworks[.]com | Domain associated with Ghostynetworks, described as an AnonRDP shell company; its SPF record shared four IP addresses with anonrdp[.]com. |
| DOMAIN | virtualine[.]net | Domain of Virtualine Technologies, which the Justice Department says also operated as Omegatech; seized by the FBI under Operation Omegaline. |
| IPV4 | 91[.]92[.]240[.]5 | Identified by Silent Push as a bulletproof-hosting IP that shifted from Railnet LLC to Omegatech. |
People
Threat Actors
Vendors
Aeza GroupAfter the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Aeza Group in July 2025, the November designations named Aeza-linked companies registered in the UK, Serbia and Uzbekistan.AnonRDPFrom February to April 2026, the SPF record for anonrdp[.]com, run by the well-known BPH AnonRDP, listed four IP addresses.Media LandIn July, US prosecutors charged three Russian nationals over BPH services, and on July 13 the EU sanctioned Media Land, its sister company ML Cloud and general director Aleksandr Volosovik.ML CloudIn July, US prosecutors charged three Russian nationals over BPH services, and on July 13 the EU sanctioned Media Land, its sister company ML Cloud and general director Aleksandr Volosovik.Omegatech LTDOmegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps BuildingRailnet LLCOn February 11, 2026, Silent Push threat analysts detected a major infrastructure shift away from Railnet LLC (AS214943), a well-known bulletproof hosting provider, toward a newly registered ASN, Omegatech (AS202412).THE.HostingThe target was THE.Hosting, also known as WorkTitans BV (AS209847), which took over the network assets of Stark Industries Solutions (KrebsOnSecurity; see also their 2024 research on Stark).Virtualine TechnologiesWithin Omegatech’s subnets, we also identified Virtualine Technologies, which the Justice Department says also operated as Omegatech.
Products
IOFA Bulletproof Hosting feedThe IOFA Bulletproof Hosting feed reclassified Aeza’s infrastructure on July 20, so it stayed flagged under the new ASN (Silent Push).Silent Push PlatformBelow you can see an example from the Silent Push platform of a bulletproof IP shifting from Railnet LLC (AS214943) to the new BPH Omegatech (AS202412).
Countries
AustraliaThe US, UK and Australia sanctioned Media Land in November 2025 (OCCRP), roughly eight months before the EU did.GermanyThe FBI Washington Field Office led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector partners OverRIPE and Lumen (JusticeNetherlandsThe FBI Washington Field Office led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector partners OverRIPE and Lumen (JusticeRussiaOCCRP: US, UK, Australia Sanction Russia-Based Cybercrime Hosting FirmsSerbiaAfter the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Aeza Group in July 2025, the November designations named Aeza-linked companies registered in the UK, Serbia and Uzbekistan.United KingdomOffice led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector partners OverRIPE and Lumen (Justice Department).UzbekistanAfter the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Aeza Group in July 2025, the November designations named Aeza-linked companies registered in the UK, Serbia and Uzbekistan.