Chapter 1: The Company That Doesn't Exist

Omegatech LTD was incorporated in the Seychelles on January 5, 2026. Seven days later, RIPE NCC created AS202412 — OMEGATECH-AS. Within three months, it was announcing 20 /24 blocks (5,120 IP addresses) to the global routing table.

Let's look at what's publicly known about this company:

"House of Francis, Room 303" is not a data center. It's not an office. It's a registered-agent address — a mailbox where dozens of shell companies share the same room number. The Seychelles International Business Company (IBC) framework was designed for exactly this: corporate formation with no public beneficial ownership disclosure, no requirement to file accounts, no cooperation with foreign law enforcement absent a Mutual Legal Assistance Treaty (MLAT).

Cost of incorporation: approximately $1,000. Time: 24-48 hours. What you get: a legal entity that can hold RIPE resources without anyone knowing who's behind it.

Chapter 2: The Sponsorship Chain

A Seychelles shell company cannot directly obtain RIPE resources. It needs a LIR (Local Internet Registry) to sponsor its allocation. This is where the architecture becomes elegant — and where a real person finally appears.

The structure is simple: Mishayev's Pfcloud UG (legitimate German business) sponsors RIPE resources for offshore entities. Pfcloud's AS51396 provides BGP transit — the actual route announcements that make these IPs reachable on the internet. Without Pfcloud, Omegatech has IPs on paper but no connectivity.

Chapter 3: The Transit Hub From Hell

Pfcloud UG (AS51396) is not just Omegatech's sponsor. It's the transit provider for an entire constellation of DROP-listed ASNs:

Seven ASNs. All on Spamhaus DROP (a list so severe it means "unconditionally block all traffic"). All routing through a single German UG with €1 minimum capital. And all — or at least the Seychelles ones — appear to be part of the Virtualine ecosystem.

Chapter 4: TechTies — The Parallel Shell

Three of our GPU-hunting IPs sit on TechTies Inc. (AS197170). Let's look at the similarities:

Same country. Same transit provider. Same DROP status. Different company name. This is not coincidence — it's redundancy. If one ASN gets depeered (loses its transit), the other continues operating. The operator is never fully offline.

Chapter 5: The 67 C2 Servers

Our interest in Omegatech started with GPU reconnaissance. But Breakglass Intelligence documented something far larger: on a single /24 subnet within AS202412, they found 67 distinct command-and-control servers across 16 malware families:

Remember: this is on the same infrastructure hosting our GPU reconnaissance botnet. The GPU hunters share an apartment building with remote access trojans, DDoS botnets, banking trojans, and cryptocurrency stealers.

This tells us something important about Omegatech's business model: it's not a specialized service. It's a bulletproof hosting supermarket — anyone with cryptocurrency and a Telegram handle can rent space. The GPU hunters are just one customer among many.

Chapter 6: The DeFi Phishing Factory

Hostile Infrastructure Research revealed another business line on the same Omegatech infrastructure. At IP address 130.12.180.128, they found 92 phishing domains targeting 14 DeFi cryptocurrency brands:

SimpleSwap (14 domains), ChangeNow (9), SushiSwap (7), Raydium (7), Hyperliquid (7), FixedFloat (6), Jupiter (4), CowSwap (3), Curve Finance (2), Meteora (2), Uniswap (1), Orca (1), GMGN (1), Changelly (on separate IP).

The operation uses a sophisticated pipeline:

1. Pre-warming (Cloudflare): Clean content builds SEO ranking on search engines
2. Staging (transitional hosts): Domain migrates off Cloudflare
3. Production (OMEGATECH): Domain flips to active wallet-drainer

The management interface was exposed at npm.bingfucks.me — an Nginx Proxy Manager instance routing all 92 domains through a single server. The domain name suggests the operator is aware of (and contemptuous of) search engines' inability to detect their pre-warming technique.

Chapter 7: KPROHOST and the Virtualine Family

There's a third entity in the Virtualine family: KPROHOST LLC (AS214940). It's almost comically similar:

• Seychelles registration ✓
• Pfcloud transit ✓
• Spamhaus DROP ✓
• Shares virtualine.org/GB Spamhaus identity with Omegatech ✓

The shared Spamhaus identity is the smoking gun. Spamhaus assigns identity markers based on operational evidence — shared infrastructure, shared abuse patterns, shared administrative contacts. When two ASNs share the same identity, Spamhaus is saying: these are the same people.

So we have at minimum three parallel shells (Omegatech, TechTies, KPROHOST), all Seychelles, all Pfcloud, all Virtualine. Why three? Because if one gets blocked by a major carrier (like Lumen or Cogent depeering a bulletproof ASN), the operator migrates customers to another. The service promise is uninterruptible hosting. Multiple shells make that promise credible.

Chapter 8: Dyachenko's Sub-Lease

Our vectorized intelligence contains one more connection: Dyachenko Valentina Ivanovna, operator of WEBNETWORK-MNT (AS57100, Ukraine), confirmed on Spamhaus ASN-DROP. Her pitline.net cluster includes 6 DROP-listed ASNs.

What's relevant: Dyachenko's IPs are sub-leased within Omegatech's AS202412 address space. This is bulletproof-to-bulletproof sub-leasing — one underground hosting provider renting space inside another. It suggests Omegatech functions as a wholesaler in the bulletproof hosting market: it obtains IP space through Pfcloud's RIPE connection, then resells portions to smaller operators who can't get their own resources.

Chapter 9: The whitelabel.sh Service

Daniel Mishayev's whitelabel.sh deserves closer examination. The service promises:

• Your own ASN (Autonomous System Number)
• IP space allocation via RIPE
• BGP transit and route announcements
• "White-label" — meaning your brand, not theirs

In legitimate networking, this is called a "sponsored PI (Provider Independent) space" arrangement. ISPs do this for enterprise customers who need their own address space but don't qualify as a RIPE LIR. The process involves RIPE due diligence: the sponsor (LIR) is responsible for the customer's compliance.

In practice: when your customer is a Seychelles mailbox with no directors, no office, and no employees, "due diligence" is a formality. The service converts anonymous offshore shells into internet-connected network operators — with legitimate BGP routing, proper RPKI signatures, and all the technical infrastructure that makes filtering difficult.

This is not a bug in the system. It's the business model.

Chapter 10: What Would It Take to Stop This?

The architecture has exactly one real-world anchor point: Pfcloud UG, registered at District Court of Passau, Germany, HRB 12249.

If RIPE NCC revoked ORG-DM262-RIPE's resources based on the "acceptable use" clause in their membership agreement, the following would lose route announcements:

• AS202412 (Omegatech) — 5,120 IPs
• AS197170 (TechTies) — unknown block count
• AS214940 (KPROHOST) — unknown block count
• AS197769 (VPSDEDICATED) — unknown block count
• AS198189 (STEALTHVM) — unknown block count
• Plus others downstream of Pfcloud's transit

This hasn't happened. Why not? Because RIPE NCC has historically been reluctant to terminate members based on downstream abuse, citing neutrality and due process. The argument: "We are a registry, not a police force." This creates the gap that the entire Virtualine ecosystem exploits.

The German legal system could also intervene — Pfcloud UG is registered in Bavaria. But a hosting transit provider's liability for customer content is legally unclear under German law (§§7-10 TMG, the "provider privilege"). Mishayev can argue he merely provides transit and is not responsible for what customers do with their IPs.

This is the architecture of impunity: each layer has a plausible defense, and no single entity bears complete responsibility.