In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥 ➡️ https://www.justice.gov/usao-edva/pr/bulletproof-website-domain-seized-international-law-enforcement-operation Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑 Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️ 🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: https://urlhaus.abuse.ch/asn/202412 📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: https://threatfox.abuse.ch/asn/202412/ The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️‍♀️ The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃 Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include: ➡️ AS219502 (STORMCLOUD) ➡️ AS207043 (DEDIK-IO) ➡️ AS214351 (FEMOIT) What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀 If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP): 🛑 https://www.spamhaus.org/blocklists/do-not-route-or-peer/