# Operation Omegaline: FBI Seizes virtualine.net, Disrupting Omegatech / Virtualine Technologies Bulletproof Hosting (AS202412)

> On 2026-10-27 the FBI seized virtualine.net under Operation Omegaline, announced by the US Attorney's Office for the Eastern District of Virginia. Virtualine Technologies, which also operated as Omegatech (AS202412), sold bulletproof hosting to cybercriminals; Silent Push reports Omegatech is not fully offline and its prefixes show very low routing visibility.

- **Published:** 2026-10-27T19:23:28Z
- **Last reviewed:** 2026-10-27T19:23:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4561
- **ID:** TL-2026-4561
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Omegaline is a multinational law-enforcement action against Virtualine Technologies, a bulletproof hosting (BPH) provider that also operated as Omegatech. The FBI Washington Field Office led the investigation; the US Attorney's Office for the Eastern District of Virginia announced the seizure of the virtualine.net domain on 2026-10-27. Partners named in the Silent Push write-up are Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the UK National Crime Agency, OverRIPE and Lumen. Silent Push describes the hosting as supporting phishing, malware and ransomware infrastructure generically; no specific malware family or threat actor is named in the primary source.

Routing and ownership history: throughout 2025 Railnet LLC (AS214943) provided the routing backbone for infrastructure used by Virtualine Technologies, letting it operate without directly owning IP space. Per Recorded Future Insikt Group (as summarised by secondary sources), announcements shifted to AS202412 Omegatech LTD as early as 2026-01-21, and Insikt assesses with high confidence that Omegatech LTD is operated by Virtualine. Silent Push independently detected the Railnet-to-Omegatech infrastructure shift on 2026-02-11, using 91.92.240.5 as an example (on BPH feeds since 2025-10-22). Per the Justice Department as quoted by Silent Push, in March 2026 Virtualine advertised an 'additional protection plan' that moved customers' criminal infrastructure, including to shell companies. The model enables frequent rotation of short-lived prefixes, complicating attribution and prolonging the lifespan of malicious infrastructure.

Observed customer abuse (independent researcher write-up, lower confidence): Virtualine/Omegatech address space was used in a ClickFix campaign. A compromised Brazilian site (absoluteinvestimentos.com.br, 191.233.203.32) presented a fake Cloudflare Ray ID verification page that led victims to run an obfuscated PowerShell (IEX/IRM) stage from 91.92.240.121, which fetched a position-independent shellcode binary ('s_enterprise') from 158.94.208.104 and executed it in memory via VirtualAlloc, Marshal.Copy and CreateThread. BeaconBeagle returned HTTP 404 for 91.92.240.5, so no C2 correlation could be recorded.

Status: Silent Push states Omegatech is not fully offline and its prefixes show very low routing visibility. Silent Push notes that a BPH can have a new ASN issued in two to five business days and that 50 of the BPH providers it tracks lost their ASNs, so re-emergence under new ASNs/shell companies is expected. Wider context: May 2026 Dutch FIOD seizure of 800+ servers (THE.Hosting/WorkTitans BV, AS209847); July 2026 US charges against three Russian nationals over BPH services and EU sanctions on Media Land and ML Cloud (2026-07-13); OFAC sanctions on Aeza Group (2025-07-01). The justice.gov announcement was not independently retrieved.

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1583.004 Server
- T1583.001 Domains
- T1584.004 Server
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1106 Native API
- T1665 Hide Infrastructure
- T1568.001 Fast Flux DNS

## Sources

- [Silent Push: Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps Building](https://www.silentpush.com/blog/operation-omegaline-fbi-seizes-virtualine/)
- [CISA et al.: Bulletproof Defense - Mitigating Risks From Bulletproof Hosting Providers](https://www.ic3.gov/CSA/2025/251119.pdf)
- [Virtualine ClickFix attribution (0xdevbot)](https://0xdevbot.substack.com/p/virtualine-clickfix-attribution)
- [Intel 471: A new era of bulletproof hosting providers emerge](https://www.intel471.com/blog/a-new-era-of-bulletproof-hosting-providers-emerge)
- [Spamhaus: Bulletproof hosting - there's a new kid in town](https://www.spamhaus.org/resource-hub/bulletproof-hosting/bulletproof-hosting-theres-a-new-kid-in-town/)
- [ThreatFox: ASN 214943 (Railnet LLC) IOCs](https://threatfox.abuse.ch/asn/214943)
- [ASD ACSC: Bulletproof hosting providers](https://www.cyber.gov.au/sites/default/files/2025-01/Bulletproof-hosting-providers.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4561