Bulletproof hosting (BPH) providers rent servers and IP space to cybercriminals and ignore abuse complaints and takedown requests, so phishing, malware and ransomware infrastructure stays online. Over the past 12 months, 50 of the BPH providers Silent Push tracks lost their autonomous system numbers (ASNs), the identifiers that tie blocks of IP addresses to a network. Not all of them are publicly known as bulletproof hosters. We identified them as BPH through our own research and data.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
An ASN can disappear for many reasons. To name a few, the BPH goes out of business, law enforcement action takes its infrastructure offline, or the BPH abandons the ASN and moves its IP ranges to a fresh one under a new front company
BPH providers still work the way they always have. What has grown is the pressure on them from law enforcement and private companies, through seizures, sanctions and arrests. The most recent example is the FBI’s seizure of virtualine[.]net, announced by the US Attorney’s Office for the Eastern District of Virginia on October 27, 2026.
Railnet, Omegatech and Operation Omegaline
On February 11, 2026, Silent Push threat analysts detected a major infrastructure shift away from Railnet LLC (AS214943), a well-known bulletproof hosting provider, toward a newly registered ASN, Omegatech (AS202412). We quickly determined that this ASN is another hotspot for a wide range of cybercrime. Within Omegatech’s subnets, we also identified Virtualine Technologies, which the Justice Department says also operated as Omegatech.
Below you can see an example from the Silent Push platform of a bulletproof IP shifting from Railnet LLC (AS214943) to the new BPH Omegatech (AS202412).
Threat feed history for 91.92.240[.]5 in the Silent Push platform. The IP has been on the Bulletproof Hosting IPs feeds since October 22, 2025, before and after the move to Omegatech.
On October 27, 2026, the FBI seized virtualine[.]net under Operation Omegaline. The FBI Washington Field Office led the investigation with Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector partners OverRIPE and Lumen (Justice Department). Silent Push did not take part in the operation, but we are pleased to see law enforcement disrupt Omegatech (AS202412).
It is important to note that Omegatech is not fully offline yet. Its prefixes now show very low routing visibility, which typically points to a serious problem on the operator’s side.
FBI seizure notice displayed on virtualine[.]net under Operation Omegaline on October 27, 2026.
Law enforcement action against BPH providers in 2026
In May 2026, the Dutch Tax Intelligence and Investigation Service (FIOD) seized more than 800 servers and arrested two men. The target was THE.Hosting, also known as WorkTitans BV (AS209847), which took over the network assets of Stark Industries Solutions (KrebsOnSecurity; see also their 2024 research on Stark).
In July, US prosecutors charged three Russian nationals over BPH services, and on July 13 the EU sanctioned Media Land, its sister company ML Cloud and general director Aleksandr Volosovik.
In late April, the fast-flux service run by the actor Yalishanda went down for several days, and Yalishanda was later banned from the Exploit forum (Intel 471). Fast flux rapidly rotates the IP addresses behind a domain to make it harder to block. As we covered in our fast flux phishing research, Yalishanda advertised custom encrypted proxy infrastructure, decoy traffic and abuse-proof hosting on behalf of Media Land, with tiered pricing up to $550 for unlimited domains.
US and EU sanctions lists diverge
We assess with high confidence that sanctions, disruption and arrests have a significant effect on the BPH ecosystem. The US and EU lists don’t line up, though. The US, UK and Australia sanctioned Media Land in November 2025 (OCCRP), roughly eight months before the EU did.
After the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Aeza Group in July 2025, the November designations named Aeza-linked companies registered in the UK, Serbia and Uzbekistan. A BPH on one list can keep serving customers through an entity, ASN or data center in a country where it isn’t sanctioned yet, and neither the OFAC list nor the EU Sanctions Tracker follows a BPH once it reappears under a new name.
Public research on BPH providers
In November 2025, nine agencies including CISA, the FBI and the UK’s National Cyber Security Centre (NCSC) published joint guidance on BPH providers. It cites Silent Push research twice and names Silent Push as a contributor alongside AWS and RedSense (advisory).
Silent Push analysts flagged Aeza Group as a BPH in early 2025, months before OFAC sanctioned it on July 1, 2025. After the sanctions, Aeza’s IPs started moving onto AS211522, an ASN allocated on July 10 that already held more than 2,100 IPs, an unusually fast ramp for a new network.
We detected the move through Indicators of Future Attack® (IOFA). IOFAs fingerprint the patterns threat actors rely on to build and manage their infrastructure, so new assets get flagged before they’re used in an attack. The IOFA Bulletproof Hosting feed reclassified Aeza’s infrastructure on July 20, so it stayed flagged under the new ASN (Silent Push).
How BPH providers replace a lost ASN
A lost ASN does not by itself mean the BPH has stopped. According to the joint advisory, a BPH can have a new ASN issued in two to five business days and move the same malicious IP ranges across. Blocklists built around the old ASN go stale almost straight away, and a BPH that comes back under a new name appears as a new network.
The speed of acquiring a new ASN is a crucial part of the problem, and we believe the process for registering an ASN should be tougher. The joint advisory already recommends that ISPs vet customers with know-your-customer (KYC) checks. Similar scrutiny before a new ASN is issued would make it harder for a BPH to rebuild after a disruption.
Virtualine even sold this as a service. According to the Justice Department, in March 2026 it advertised an “additional protection plan” that moved customers’ criminal infrastructure to an unaffiliated shell company after law enforcement requests, then reactivated the server.
Shared records can link a BPH to its fronts. A Sender Policy Framework (SPF) record lists the IP addresses allowed to send email for a domain. From February to April 2026, the SPF record for anonrdp[.]com, run by the well-known BPH AnonRDP, listed four IP addresses. The SPF record ghostynetworks[.]com published today lists the same four. Ghostynetworks (AS205759), a shell company of AnonRDP, has also disappeared recently.
PADNS TXT records for ghostynetworks[.]com and anonrdp[.]com in the Silent Push platform. Both domains’ SPF records list the same IP addresses.
Because we track BPH providers by their operating patterns, such as WHOIS red flags and unusual IP allocation, the Bulletproof Hosting IOFA feed can flag new ASNs, IP ranges and hosting providers as BPH operators migrate.What to Block and Monitor Now
- IOFA feeds: Bring the IOFA Bulletproof Hosting feed, which requires an Enterprise subscription, into existing security tools through Silent Push integrations to block or flag BPH infrastructure, and to prioritize alerts by risk without researching each IP or ASN by hand.
- ASN monitoring: Refresh ASN and IP blocklists often, and watch for newly allocated ASNs that fill up with IPs quickly, especially when the ranges belonged to a recently sanctioned or seized BPH.
- Sanctions screening and sharing: Check hosting providers against both the OFAC list and the EU Sanctions Tracker, and share BPH findings through public and private channels, as the joint advisory recommends.
Interested in Learning More?
- Download our free Bulletproof Hosting White Paper here to understand current state of the practice of Bulletproof Hosting, and get to know the lesser-known technical dynamics we’ve been observing.
- Book a demo with a Silent Push platform expert to see the Bulletproof Hosting IOFA feeds in action.
- Sign up for the free Silent Push Community Edition and start exploring today.
Sources
- Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers (CISA et al.)
- Silent Push IOFA Feed Detects Aeza Group Infrastructure Shift
- Intel 471: A New Era of Bulletproof Hosting Providers Emerge
- ELLIO: Sanctioned, Seized, Still Scanning
- Aviatrix: US Charges Russian Bulletproof Hosting Operators
- A Global Public-Private Partnership Just Got Preemptive
- OCCRP: US, UK, Australia Sanction Russia-Based Cybercrime Hosting Firms
- KrebsOnSecurity: Bulletproof Host Stark Industries Evades EU Sanctions
- OFAC Sanctions List Search
- EU Sanctions Tracker
- Silent Push Integrations
The post Omegatech Is Disrupted , and the Pressure on Bulletproof Hosting Keeps Building appeared first on Silent Push.
Article Link: Operation Omegaline: FBI Seizes Virtualine | Silent Push