Virtualine Takedown: Inside the Omegatech Bulletproof Host, Seen From Our Honeypots

On 27 October 2026 the FBI seized virtualine[.]net, the website of a bulletproof hosting provider that the US Justice Department says also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Silent Push calls the action Operation Omegaline. A day later, Dutch police said they had seized dozens of physical servers in a data centre in Limburg, taking hundreds of virtual servers offline, and that they now hold data on more than 3.000 customers.

Omegatech's address space kept sending traffic to Whatoblock's honeypot sensors until the morning of the seizure. That lets us describe the operation from the receiving end: who its customers attacked, what they sent, which malware servers the network hosted, and the minutes in which it went dark.

This article covers the 31 days from 27 September to 27 October 2026, with history back to August for the network's activity and to December 2025 for its malware servers.

The short version

• 570 addresses from Omegatech's ranges sent 4.108.184 events to our network and reached all 224 of our sensors in all 39 countries. None of them belonged to a research scanning project.
• 120 addresses were used mainly for mail abuse, sending advance fee fraud and bank phishing to 2.112.582 recipients, most of them Yahoo, Gmail, AOL and Hotmail users.
• Other customers brute forced remote desktops, probed Ivanti VPN gateways 6.000 to 12.000 times on most days, hunted for leaked .env files and cloud keys, and checked stolen proxies against Gmail and Office 365.
• We recorded 47 malware servers in the network's ranges. Eight of them kept the same address when the space moved from Railnet to Omegatech in January, including a RedTail cryptominer server that 1.575 infected devices tried to spread.
• Between 07:40 and 07:50 UTC on 27 October, activity fell from six ranges to one, more than two hours before the routes were withdrawn. The last range stopped at 13:12 UTC, and no event has reached us from any Omegatech range since.
• Infected devices are still spreading a loader that points at a seized server. On 28 October, 20 different devices did so.

What was seized, and by whom

The US Attorney's Office for the Eastern District of Virginia and the FBI Washington Field Office announced the court authorised seizure of virtualine[.]net on 27 October. Germany's Polizei Hessen, the Dutch police unit for Central Netherlands, the UK National Crime Agency and two private partners, OverRIPE and Lumen, supported the operation.

According to the Justice Department, Virtualine told a forum user in September 2024 that its servers could be used for "all illegal/black hat activities", including phishing, carding and email spam, and boasted in June 2025 that it had "ignored more abuse than your last three therapists". In March 2026 it advertised an "additional protection plan": after an official request from law enforcement, it would move a customer's criminal infrastructure to a shell company not linked to Virtualine and switch the server back on. Customers paid in bitcoin to addresses labelled "BTC [NO-AML]".

The Justice Department also says Virtualine hosted a forum where users sold sexual images of minors and adults and offered hacking services to steal intimate content. From January 2026 it received warnings about the forum from police in Germany, Canada and Australia and from NCMEC, and kept it online.

No operators have been named and no charges announced. Within hours, Virtualine posted an open letter on virtualine[.]org disputing the allegations and saying it could rebrand quickly, and its Telegram channel told customers their data was safe. The Dutch police say they hold data on more than 3.000 customers and are taking follow up action against them.

One host, many names

Registry and routing records show how the network behind Virtualine changed its name:

Across both names, the network announced 71 IPv4 prefixes with 18.944 addresses. Omegatech alone announced 27 prefixes with 6.912 addresses, 16 of them taken over directly from Railnet. Most of the space was registered to other address holders, and its registry contacts were rewritten each time the host changed its front.

Railnet and Omegatech announced the same address space one after the other. Source: RIPEstat routing history.

The customers did not move with the name. Several of their servers kept the same addresses through the rename, as the malware server section shows.

What Omegatech's customers did

In our 31 day window, 570 addresses inside Omegatech's prefixes sent 4.108.184 events to our sensors. They reached all 224 sensors in all 39 countries we cover and used 301 different protocols. The United States received the largest share, 1.583.932 events (39% of the 4.108.184), followed by Spain, the United Kingdom and Germany.

Addresses from Omegatech ranges on our sensors per day since 1 August. The jump on 8 October is the 45.74.59.0/24 sweep.

We sorted each address by what it mainly did. The event column counts every event of that kind, whichever address sent it.

None of the 570 addresses belonged to a research scanner, and nearly every activity in the table is an attack, a fraud campaign or preparation for one.

Events by activity, with the number of addresses mainly used for each.

Some customers rented a whole block or a run of neighbouring addresses for one job, which makes them easy to pick out. Others shared ranges that behaved like a pool of small virtual servers, each running its own spam sender, proxy checker or password guesser.

Mail fraud: 2.112.582 recipients

Mail was the most common use. 136 addresses sent mail traffic, 120 of them mainly for that purpose. 20 addresses delivered 224.530 sessions with a complete message, addressed to 876.464 recipients, and 23 more sent 204.520 sessions listing another 1.207.030 recipients. Another 111 addresses ran 11.081 relay tests, short messages that check whether a mail server will forward mail for strangers, with subject lines such as "test smtp", "Valid SMTP" and "Email Tester".

A few servers did most of the sending. 14 addresses sent 760.357 of the 787.909 events from the 120 mail addresses, more than 96%. One of them, 158.94.208[.]192, sent 416.822 events in three days.

Most recipients had consumer mailboxes. Of the 2.112.582 recipient lines, 31% were Yahoo addresses, 24% Gmail, 8% AOL and 6% Hotmail.

Most of the messages were advance fee fraud. One address sent 150.696 messages titled "VICTIMS OF FINANCIAL CRIME", another sent 72.424 "Bequest notice" messages, and dozens of smaller waves offered "compensation funds". A smaller campaign impersonated USAA, the bank used by US military families, with "You Have New USAA Documents" messages built from USAA's own images.

Between 27 and 30 August, one address, 158.94.210[.]90, generated 16.183.989 mail events on our sensors, peaking at 377.499 in one hour, about 105 every second.

Breaking in: RDP, VPNs and edge devices

146.19.125[.]182 alone made 638.721 RDP connection attempts against 172 of our sensors in six days, on nonstandard ports as well as the usual one. The usernames it guessed read like a small office: backup, copier, quickbooks, shop and staff. Across the network, 36 addresses opened 700.122 RDP connections without a username, typical of automated RDP scanning and brute force tools, and one used the Ncrack password tool, which names itself in the connection.

43 addresses sent 189.814 requests to the login page of Ivanti Connect Secure, the VPN product behind CVE-2025-0282, at 6.000 to 12.000 requests on most days until the seizure. One address, 130.12.180[.]40, sent 182.587 of them.

Over five days, 91.92.243[.]63 tried 139 usernames and 182 passwords 19.615 times against the FortiGate VPN login page, all aimed at sensors in a single country. Its most frequent guesses were admin, guest, 123456 and fortinet.

The same ranges also tried Cisco ASA, Atlassian Confluence and Microsoft Exchange flaws, and password logins on Palo Alto GlobalProtect VPNs.

Harvesting secrets

Nine neighbouring addresses in 94.154.46.0/24 worked through the same list of about 1.750 file paths again and again on every web sensor they found, and all 747.012 of their requests claimed to come from Googlebot. The list covered .env files and their backups, .git/config, .aws/credentials, wp-config.php copies and Docker Compose files, which hold database passwords, API keys and cloud credentials. The same nine addresses had been at work since 31 August, with 4.212.706 events before they stopped in early October. Across the network, 39 addresses sent 537.029 requests of this kind.

Encrypted floods

Five addresses in 178.16.52.0/24 and 178.16.55.0/24 sent 1.233.422 events between them on almost every day, nearly all of them TLS handshakes to web ports. The volume and regularity point to automated infrastructure. The few readable requests they sent asked for the Cisco ASA VPN login page.

A whole range used as one scanner

On 8 October, 253 of the 256 addresses in 45.74.59.0/24 started scanning at once. Each sent only about 44 events in total, probing Android Debug Bridge, Hadoop and MLflow, services that let an attacker run code if left open. The ports rotated every three days, and the busiest address produced less than 1% of the range's traffic. Spread across a full range like this, a sweep stays below the per address thresholds many defences use, which is a good reason to block bulletproof ranges whole.

A second range worked the same way on a smaller scale. From 6 to 16 October, 19 addresses in 104.250.184.0/24, picked at round numbers, scanned industrial control systems, laboratory equipment, game servers and developer tools across more than 90 of our sensors each.

The vulnerabilities they went after

Omegatech's addresses tried 30 different CVEs, from a 2017 Apache Struts flaw to last year's CrushFTP and SAP bugs. Most were tried by one or two addresses running broad exploit scanners, while 43 addresses took part in the Ivanti campaign.

The malware servers in the next section add two more outside this table: CVE-2021-41773, which infected devices elsewhere used to spread RedTail, and CVE-2023-48022, used to plant a cryptominer in August and September.

Testing stolen proxies

48 addresses mainly tested open proxies. Besides proxy checking services, they tried to reach Gmail, Yahoo, Office 365 and Amazon SES mail servers through each proxy, the step before using it to send spam from someone else's address.

The malware servers

Criminals also rent bulletproof hosting for command and control (C2) servers and download sites, the servers their malware calls home to.

Since 17 December 2025 we recorded 47 malware servers inside the network's prefixes: 24 while the space was Railnet's and 31 under Omegatech.

A SANS Internet Storm Center diary documented the RedTail server in April. By then it had been serving the miner for four months and had survived a change of network.

Eight of the 47 servers, including the RedTail server, appear under both Railnet and Omegatech with the same address: the ASN changed around them while the servers kept running. That is the continuity the Justice Department's "additional protection plan" advertised.

Recorded Future counted more than 30 malware families on Railnet space in 2025, and Breakglass Intelligence mapped 67 C2 operations across 16 families in a single Omegatech /24 in April 2026. Addresses that Intrinsec listed among the top Omegatech attackers in March were still attacking us in August and September: 94.154.35[.]215 made 37.125 SSH attempts on our sensors between 16 August and 17 September.

The takedown, minute by minute

All times are UTC on 27 October.

• Until 07:40, a normal night: usually 23 to 29 addresses an hour from Omegatech ranges were active on our sensors.
• From 07:40 to 07:50, activity collapsed. Active addresses per 10 minutes fell from 15 to 5, and active /24 ranges from 6 to 1. The last events from 178.16.52.0/24, 178.16.53.0/24, 178.16.55.0/24 and 91.92.240.0/24 arrived between 07:48:32 and 07:49:22.
• At 08:59, the last event from 91.92.242.0/24 arrived.
• From about 10:00 to 13:47, public routing data shows Omegatech's routes being withdrawn. The last announcement for 91.92.240.0/24 was at 10:39.
• At 13:12:21, the last event from any Omegatech address reached our sensors. It came from 130.12.180.0/24, which stayed active for five hours after the rest, and from the address of the Mirai style loader server.
• Since then, not one event has reached us from any of the 27 Omegatech prefixes up to the time of writing on 29 October.

Most of the network went quiet more than two hours before its routes disappeared. That fits servers being switched off in the data centre, with the routing changes coming afterwards. Our data shows the timing, but not what happened inside the building.

Active Omegatech ranges per 10 minutes on 27 October. The shaded band is when the routes were withdrawn.

Infected devices still point at a seized server

Devices infected with the Mirai style loader keep trying to spread it, and the copies they send still tell new victims to download from 130.12.180[.]212. On 28 October, 20 different infected devices were still spreading that loader, and on 29 October another 16 by midday.

Where the customers went

Two days is a short time, and we only see the customers whose traffic reaches our sensors. We looked for the same campaigns on other networks, before and after the seizure.

None of the campaigns we followed has come back at anything like its old volume. No "VICTIMS OF FINANCIAL CRIME" or "Bequest notice" message has reached us from any network since 13:12 UTC on 27 October, and the Ivanti campaign's main address has no successor. The few other networks sending the same Ivanti request pattern were already doing so before the seizure.

Some spammers were already moving between hosts. The "VICTIMS OF FINANCIAL CRIME" campaign ran from 149.104.105[.]35 on another network from 11 to 20 October, sending 366.456 events to one of our mail sensors, then switched to 91.92.241[.]9 on Omegatech the next day and carried on against the same sensor. A spammer working this way loses one sender in a takedown and keeps the rest.

One sweep that looks related is still running. 45.74.28.0/24, announced by a different network (AS219326), started scanning on 7 October, a day before Omegatech's 45.74.59.0/24. It used its whole range the same way, sent the same browser style request headers and rotated the services it probed on a schedule, and it kept going after the seizure, with 73 active addresses on 28 October. We cannot prove the two ranges belong to one operator. If they do, the seizure took away half of the operation.

What happens next

Virtualine says it can rebrand in "a day, perhaps even less". A joint advisory from CISA, the FBI and partners in November 2025 warned that bulletproof hosts can get a new ASN in two to five business days and move their ranges onto it. Silent Push counts 50 bulletproof providers in its tracking that lost their ASNs in the past 12 months.

One former Omegatech prefix, 94.26.38.0/24, was already announced by a different network on 28 October, though it has sent us nothing since. Most of Omegatech's space was leased, so if the same blocks reappear under a new name, the operator has probably moved. Dutch police obtained data on more than 3.000 customers, and those whose infrastructure was disrupted may move their phishing kits, spam senders and C2 servers to other hosting networks.

What to block

Blocking by ASN would have failed twice already, in January and again now. Block the address ranges, and keep blocking them after they change hands until they prove clean.

These are the 27 prefixes Omegatech announced:

45.74.7.0/24
45.74.20.0/24
45.74.40.0/24
45.74.57.0/24
45.74.59.0/24
45.132.180.0/24
91.92.240.0/24
91.92.241.0/24
91.92.242.0/24
91.92.243.0/24
94.26.38.0/24
94.154.35.0/24
94.154.40.0/24
94.154.46.0/24
104.250.184.0/24
130.12.180.0/24
146.19.125.0/24
158.94.208.0/24
158.94.209.0/24
158.94.210.0/24
158.94.211.0/24
172.111.246.0/24
178.16.52.0/24
178.16.53.0/24
178.16.54.0/24
178.16.55.0/24
193.30.241.0/24

If you feed a firewall from a blocklist, the integrations guide shows how to load ranges like these into common firewalls and SIEMs. Some of these ranges belong to holders who leased them to Omegatech and may lease them to legitimate customers in future, so review the list after a few months.

Frequently asked questions

What was Virtualine?

A bulletproof hosting provider that, according to the US Justice Department, openly advertised its servers for phishing, carding, spam and other crime, ignored abuse reports and offered to move customers' servers to a shell company when police asked. It also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

What is Operation Omegaline?

The name Silent Push uses for the international action against Virtualine announced on 27 October 2026, in which the FBI seized virtualine[.]net and Dutch police seized dozens of servers in Limburg.

Is Omegatech the same as Virtualine?

The Justice Department lists Omegatech as one of Virtualine's names. Registry records show Omegatech's ASN, AS202412, taking over the address space of Railnet LLC, which earlier research identified as Virtualine's legal front, in January 2026.

Is Virtualine's network still active?

Not as far as our sensors can see. The last event from any Omegatech address reached us at 13:12 UTC on 27 October, and nothing has arrived since. The operator says it can rebrand, so its customers may reappear elsewhere.

Should I block AS202412?

Yes, but blocking the ASN alone is not enough. The same address space moved from one ASN to another in January without the servers changing. Block the 27 prefixes listed above.

About this data

• Sensors: 224 Whatoblock honeypot sensors in 39 countries.
• Window: 27 September 2026 00:00 to 27 October 2026 14:00 UTC, after the last Omegatech event, with longer history for daily activity and malware servers.
• Which addresses count: every address inside a prefix announced by AS214943 or AS202412, during the period that ASN announced it, according to RIPEstat routing data.
• Activities: each address is counted once, under the activity with the most events. Mail recipients are counted from the recipient lines in each session, so one person can be counted more than once.
• CVEs: a CVE listed here was attempted, not necessarily successful.
• Sources: US Justice Department and FBI announcement, Politie statement of 28 October 2026, the November 2025 joint advisory on bulletproof hosting, Silent Push, Recorded Future, Intrinsec, Breakglass Intelligence, the SANS Internet Storm Center and RIPEstat.
• Limits: our sensors see attacks on the services they emulate. Phishing websites, CSAM hosting and C2 traffic that never touches a sensor are outside our view, so this is the part of Virtualine's business that reached out to the internet, not all of it.