Omegatech: Seychelles, fraud infrastructure and the connection to TALE-VAULT

01 · Entity and infrastructure

Entity and infrastructure

Omegatech appears in investigations into fraudulent investments, malware distribution and communications used to control compromised computers. Its name belongs to a hosting company identified on the Internet as AS202412. That network identity makes it possible to follow infrastructure that remains recognizable as the pages, offers and files moving through it change.

The organizational information in its network registration places Omegatech LTD in Seychelles, with an address at House of Francis, Mahé, and the number 410583. This is the identity declared in those records. The documentation reviewed does not establish the identities of its shareholders or beneficial owners. It also does not justify presenting a technical contact as an owner. That part of the company remains unresolved in this investigation.

Seychelles is the location declared in its network registration; its operation depends on connections to other Internet providers. As of 20 October 2026, the routing information consulted shows Omegatech announcing 24 blocks of Internet addresses, connected through three upstream networks. The infrastructure retains connectivity regardless of what may have happened to a particular page previously hosted there.

02 · Risk distribution

Risk distribution

Expanding the review of the hosting infrastructure adds another dimension. In the snapshot from an external reputation source consulted on 20 October, 2,623 of the 6,144 addresses considered were listed, approximately 43%. The distribution was 567 critical, 852 high, 1,031 medium and 173 low. Critical and high together accounted for 1,419 addresses, close to 23% of the address space considered. These classifications apply to Internet addresses, not pages or affected individuals. Malware and phishing were the most numerous labels and could overlap on the same address. Alongside the individual cases, the investigation therefore contains a set of addresses flagged at different risk levels within the infrastructure being examined.

Open full-size graphic

03 · Malware and hosting functions

Malware and hosting functions

Within this infrastructure, malware evidence reveals different stages of an attack. Some cases involve compromised legitimate websites presenting a fake verification. An interaction on the page copies a command and directs the visitor to execute it outside the browser. PowerShell then retrieves a script. The hosting service has a specific role: serving the content that enables the next stage of the chain.

Other published investigations reconstruct delivery through HTA and MSI files, direct code retrieval and subsequent communications with control servers. There is also a specific record associating an Omegatech address with DCRat, a remote-access Trojan. The evidence separates the server delivering content from the server receiving malware communications. These are different functions within the chain, even when they share a hosting provider.

Distribution can also have its own management system. The published analysis of ErrTraffic describes components that organize configuration, sessions, events and downloads, alongside a historical set of domains hosted by Omegatech. Here, the infrastructure supports a fake-verification mechanism designed to lead the user into executing code. The hosting relationship is time-bound: part of that set subsequently moved to another service layer.

04 · Abuse notices and continuity

Abuse notices and continuity

Alerts and abuse notices add a timeline to the story. One public record documents a notice sent on 8 August and an observation of the resource being offline on 29 August. Another notice, sent on 17 August, also has an offline observation on the 29th. In a third case, the notice of 2 September was followed by an offline observation the next morning. The intervals differed: approximately three weeks, twelve days and nineteen hours.

Open full-size graphic

These records show notices and changes in availability. They do not identify who caused each resource to go offline. Understanding why Omegatech continues to operate therefore requires looking beyond an individual URL. Removing a page, domain or file affects one resource; disconnecting a network involves other parties and decisions. Registrars, hosting providers and connectivity providers occupy different positions. In operational terms, that separation helps explain how reported resources can disappear while the network infrastructure remains connected.

05 · The TALE-VAULT connection

The TALE-VAULT connection

The connection with my work appears in the TALE-VAULT investigation published by CTI LATAM: https://cyberthreatintelligence.lat/informe/tale-vault/. Between 6 September and 6 October 2026, the corpus gathered 5,291 observations and 3,622 distinct domains: 3,003 entry domains and 619 destinations. That is the scope of the TALE dataset investigated. Within the preserved technical material, I identified four chains whose initial pages were hosted by Omegatech.

Opening those documents revealed a more precise relationship than shared hosting alone. All four contained a minimal structure that directed the browser to another page. The offer's name traveled with that navigation as a parameter: Kronex Kraft, Profina Fundecor, Bitpie Wallet or Iberdrola. The commercial presentation changed, but the way the journey was constructed repeated.

After reaching different destinations, all four pages communicated with the same API. Their requests retained a common set of fields and received responses from the service. That repetition connects the entry pages with a later TALE-VAULT component. Omegatech thus appears as one of the hosting providers identified in my investigation, with an observable function in the financial journey.

The reconstruction begins with each website's first response. The browser received a document containing instructions, in HTML and JavaScript, to open another destination. The page change was embedded in the delivered content. This detail allows the entire journey to be reconstructed: where it began, which instruction triggered the navigation and which service appeared afterward.

The four records are dated 10 and 25 September and 4 and 5 October. That spacing matters because the structure repeats across separate observations involving four different commercial offers. The entry pages share hosting and technical headers. Their destinations then diverge before the chains meet again at TALE-VAULT's interaction service. The relationship rests on the preserved sequence as well as the shared provider.

The division of functions is visible: one host receives the first visit, another page develops the presentation and a common interface handles subsequent requests. The records preserve successful responses to those requests. The available content traces navigation and communication with the service; it does not reconstruct payments or financial losses suffered by identified individuals.

Open full-size graphic

06 · Latin America

Latin America

Latin America enters the story in two ways. Pages classified as phishing present offers for Argentina and Colombia, with reported infrastructure connected to Omegatech. Compromised websites in Argentina and Brazil have also been used to distribute fake verifications. In one case, the region appears as the audience for the commercial offer; in the other, as part of the web surface used to circulate the attack.

07 · Conclusion

Conclusion

At the close of this review, Omegatech's network remains connected. The routing check does not establish which campaigns are operating today. The record does preserve a historical sequence: documented malicious content, abuse notices, resources that stopped responding and financial chains connected to TALE-VAULT.

Following that sequence explains why Omegatech matters beyond a single address. The investigation connects a hosting entity with specific functions in malware and fraud journeys. When a page disappears, those relationships remain as verifiable starting points for further tracking.

08 · Authorship and version

Authorship and version

Ezequiel Jorge La Terra ORCID 0009-0008-1677-4218: https://orcid.org/0009-0008-1677-4218