Threat intel

On October 27, 2026, the US Attorney's Office for the Eastern District of Virginia and the FBI Washington Field Office announced the court-authorized seizure of virtualine.net, the main domain of the Virtualine hosting service. The Department of Justice (DOJ) says Virtualine also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech, and that it hosted infrastructure for ransomware operators, infostealers, carding and credential-theft forums, scam operations and child sexual abuse material. The action, called Operation Omegaline, involved Germany's Polizei Hessen, the Dutch Politie Midden-Nederland and the UK National Crime Agency, with Chainalysis, Lumen and the researcher group OverRIPE in support.

Virtualine is a bulletproof hosting (BPH) provider: a company that rents servers and IP addresses to criminals and ignores abuse reports and legal requests. That makes its address space a useful signal for defenders. A laptop talking to a Virtualine server, or a sign-in to your identity provider from one, has no business reason behind it. Domain seizures rarely take a host's servers offline, and the operator has already said it may rebrand, so the networks below are worth checking in your logs now.

How a bulletproof host works

A normal hosting company gets a block of IP addresses from a regional internet registry (RIPE NCC, in Europe) and announces it to the rest of the internet under an autonomous system number (ASN), the identifier that routers use to know which network owns which addresses. When it receives an abuse complaint or a court order, it suspends the customer. A bulletproof host does the same technical work and skips the second part.

Virtualine said so in its own adverts. According to Chainalysis and the DOJ material, a September 2024 post on the Exploit.in forum said customers could use the service for "all illegal/black hat activities", excluding only child content and terrorism. In June 2025 it told HackForums readers that it "ignored more abuse than your last three therapists." Prosecutors also allege it kept hosting a forum that sold sexual images of minors and adults after notices from several countries, and helped that customer build a new upload site.

The hard part for defenders is that the operator can move. In March 2026, per the DOJ and Chainalysis, Virtualine sold an "additional protection plan": when a law enforcement request arrived, it moved the customer's infrastructure to an unaffiliated shell company and then switched the servers back on. The November 2025 joint guidance on BPH from CISA, the FBI, the UK National Cyber Security Centre (NCSC) and six other agencies warns that a BPH can obtain a fresh ASN in two to five business days and shift its IP ranges onto it.

Payment followed the same logic. The DOJ alleges Virtualine took bitcoin directly to unhosted wallets, which skips the identity checks that exchanges run, and laundered the proceeds. Chainalysis says its on-chain analysis links those wallets to ransomware operators, infostealer infrastructure, Russian-language forums, illicit shops and phishing addresses.

Where Virtualine ran, and what is left

Silent Push, which tracks BPH networks, saw infrastructure move on February 11, 2026, from Railnet LLC (AS214943), a known bulletproof network, to Omegatech (AS202412), an ASN registered shortly before. Virtualine sat inside Omegatech's subnets, and the DOJ confirms the two are the same operation. Silent Push gives 91.92.240[.]5 as an example address that was on its BPH feed from October 22, 2025, before and after the move.

After the seizure, Silent Push and Mallory both report that Omegatech is not fully offline: its prefixes are still announced but with very low routing visibility, which Silent Push says usually signals serious trouble on the operator's side. Virtualine posted an open letter on virtualine.org denying that it knowingly hosted abuse material, and its Telegram channel told customers their data was safe. No arrest has been announced, and none of the sources name the ransomware or infostealer families that used the service.

This is one of several BPH actions in the past 18 months. The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned Aeza Group on July 1, 2025, and Silent Push found its addresses on a new ASN, AS211522, allocated on July 10 and holding more than 2,100 IP addresses. In May 2026 the Dutch fiscal police (FIOD) seized more than 800 servers from THE.Hosting (AS209847) and arrested two men. Silent Push counts 50 BPH providers that lost their ASN in the last 12 months. Each time, some customers simply moved.

What to do

Work through these in order. The first two tell you whether you were touched; the rest keep the block useful.

1. Pull the current prefix lists. Get the prefixes announced by AS202412 (Omegatech) and AS214943 (Railnet), for example from RIPEstat at https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS202412. Ask for a start date of February 2026 or earlier, so you also get ranges that have since been withdrawn.
2. Search your logs back to at least October 2025. Match firewall, proxy, DNS and endpoint detection logs against those ranges for outbound connections. A workstation reaching one of them is a likely infostealer or remote access trojan calling home. Then search inbound authentication: in Microsoft Sentinel, SigninLogs | where AutonomousSystemNumber in (202412, 214943), and the same filter on AADNonInteractiveUserSignInLogs. Do the same on VPN, Remote Desktop Gateway and SaaS admin logs by IP range.
3. Block, with a risk check. The joint guidance recommends filtering at the ASN, subnet or single IP level depending on what a risk analysis allows. For these two networks there is little legitimate traffic to lose, so blocking egress and ingress for the whole ASN at the perimeter firewall or secure web gateway is reasonable. Log the denials so each one also shows up as an alert.
4. Refresh the list on a schedule. A static ASN list goes stale in days. Re-pull announced prefixes daily or weekly, and watch for a newly registered ASN that suddenly holds a large number of addresses, as AS211522 did after the Aeza sanctions. Commercial BPH feeds track these moves for you.
5. If you get a hit, treat the host as compromised. Isolate it, take a memory and disk image, reset every password saved in its browsers and revoke the user's sessions and refresh tokens, since stealers take cookies as well as passwords. For an inbound sign-in from these ranges that succeeded, reset the account, revoke sessions and review mailbox rules and new MFA methods registered after that time.

If you run a hosting or cloud business, the guidance's main ask is aimed at you: verify customer identity before leasing IP space, and act on abuse reports. BPH operators often resell capacity leased from legitimate data centres.

What the seizure changes

Taking a domain removes the shop window, the billing site and the support channel. It does not unplug servers that sit with upstream providers in other countries, and Virtualine's own March 2026 product was built to survive exactly this. The routing data from the first day suggests real damage to Omegatech, but customers who paid for that protection plan are likely already somewhere else.

A single seized domain blocked in your DNS filter does little. A daily-updated set of BPH prefixes, matched against outbound and sign-in logs, will also catch whatever Virtualine becomes next.

Our security operations team can build these network reputation checks into your log searches and alerts, and our attack surface management service watches what your own internet-facing systems are talking to. To have someone check your logs for traffic to these networks, open the chat and Yaali, our AI agent, will pass the question to an engineer.

---

Sources: US Attorney's Office, Eastern District of Virginia, Chainalysis, Silent Push, Mallory, LowEndSpirit discussion, NCSC New Zealand copy of the joint BPH guidance, Australian Cyber Security Centre on the BPH guidance, RIPEstat announced prefixes API.