A hosting disruption can break a provider's recovery service without preventing its customers from rebuilding. That distinction matters when investigators decide whether a disrupted operation still deserves dedicated replacement-path tracking.
DOJ says Virtualine advertised a plan to move customers to another shell company after an official law-enforcement request. The reviewed evidence establishes the advertised proposition, not successful delivery after the domain seizure.
The customer's alternatives change the outcome. Someone with current backups, working credentials, funds, and substitute hosting may migrate without the original provider. A reappearing service therefore establishes customer continuity before it establishes provider recovery. Shared infrastructure is a lead; the stronger finding links the provider to the act of restoration.
The full analysis compares those options and asks what evidence makes continued monitoring—or a narrow closure decision—defensible.