Internet Weather Report

AS403005, also known as BLATANTHOST and registered to Blatant Technologies, LLC, is now on the ASN watchlist.

New ASN. Plenty of familiar internet garbage.

ARIN registered the ASN on September 25, 2026. By October 11, it was originating nine IPv4 /24s containing 2,304 addresses. Spamhaus already includes AS403005 in its ASN-DROP feed.

Observed traffic in my firewall logs

I checked every currently announced prefix against my own firewall data. During the seven days ending October 11, 2026, at 11:54 AM PT, the logs recorded 188 blocked TCP SYN packets from 14 source IPs across six of the nine prefixes.

The zeroes describe this observation window. They do not establish that a block is clean.

The clearest scanner source was 43.228.157.57. On October 11, between 03:14:05 and 04:12:11 PT, it sent 131 TCP SYN packets to one monitored endpoint, touching 131 different destination ports.

The scan included ports as low as 1 and as high as 65056, with examples including 443, 2222, 3128, 6969, 8080, 8888, and 44444. Source ports stayed within 9001–9099. Every packet was dropped.

That is a broad TCP port sweep against a single target.

Another source, 64.89.161.172, sent 31 SYN packets to 11 ports within a two-second span on October 8. Those probes included ports 80, 443, 8443, 10000, 4433, 4443, and 4444.

These logs establish unsolicited reconnaissance. They show connection attempts blocked by the firewall; they do not show a successful compromise.

AbuseIPDB: reports in every block

I also checked all nine netblocks on AbuseIPDB. The October 11 snapshot showed 1,175 reported IP addresses and at least 626,692 reports across the blocks.

Each prefix below links to its block report.

These are AbuseIPDB’s displayed historical report totals, including reports predating AS403005. The plus signs make the combined number a lower bound. They are not a seven-day tally, unique attacks, or proof that every listed IP is currently malicious.

Still, the blocks with no hits in my local window have report histories too. One quiet firewall does not erase that history.

Malware-download infrastructure

The public evidence goes well beyond my firewall hits.

URLhaus’s official recent feed contained 70 direct-IP URL records across 10 IP addresses in seven of AS403005’s nine prefixes, each classified as malware_download and either newly added or last observed online during the same seven-day window. Twenty-two were marked online when the feed was retrieved on October 11.

Those are URL records, not infections or unique malware samples. The tally excludes URLs using domain names.

URLscan gives us another view of what these servers actually delivered. I went through all 896 results available in the October 11 ASN search. Of those, 146 result rows displayed a Downloaded Files entry, covering 72 distinct displayed URL strings on 10 primary IPs in AS403005.

That is a download-observation count, not a malware count. It includes repeated scans and incomplete transfers. The broad ASN search can also match subresources, so the examples below were checked against the primary IP, ASN, and request details.

Some representative receipts:

• 64.89.160.48/bins/pmpsl — URLscan recorded a complete 101,840-byte MIPS ELF download on October 11. URLhaus lists that exact URL as malware_download with elf and mirai tags, and last observed it online on October 11. URLscan record, URLhaus record.
• 46.151.182.200/mips — URLscan recorded a complete 233,500-byte MIPS ELF download on October 9. URLhaus tags the URL elf and gafgyt. It was last observed online October 11, but marked offline at feed retrieval. URLscan record, URLhaus record.
• 43.228.157.73/47.exe — URLscan recorded a complete 8,192-byte Windows PE executable download on October 4. URLhaus classified the same URL as malware_download and still marked it online in the October 11 snapshot. URLscan record, URLhaus record.
• 64.89.161.65/sostener.vbs — URLscan captured an HTTP 200 response for the HTTPS version on October 9, served by 64.89.161.65. URLhaus tags that HTTPS URL vbs and xworm; it was marked offline at retrieval. URLscan HTTP transactions, URLhaus record.
• stanarcservice.com, served by 64.89.160.51 — URLhaus lists /s.ps1 with ClickFix and ps1 tags, along with /asset/update.dat and a .bin payload on port 8443. October 11 URLscan records confirm the serving IP and complete downloads of the 3,411,811-byte update.dat and 27,770,384-byte .bin. Interestingly, URLscan identifies update.dat as PNG image data. Its filename alone tells you very little. URLscan: PowerShell record, update.dat download, .bin download. URLhaus: PowerShell URL, update.dat URL, .bin URL.

URLscan corroborates hosting and delivery at the recorded times. Its inspected verdicts said No classification; the malware-download classifications and family tags above come from URLhaus. Some scans were automatically submitted from URLhaus, so these are complementary records rather than two independent malware verdicts.

There are remote-access installers in the listings too, including ScreenConnect URLs on 36.255.97.68 that URLhaus flags as malware_download. ScreenConnect is legitimate software that can be abused; finding its installer does not make the product itself malware. URLscan record, URLhaus record.

Seychelles on paper, Kentucky in the contacts

BGP Tools’ Whois page shows Blatant Technologies, LLC at 306 Victoria House, Victoria Mahe, Seychelles. Follow the linked ARIN network-operations contact and abuse contact, and both give 6844 Bardstown Road in Louisville, Kentucky.

That Kentucky address is PostalAnnex #15018. The shop advertises private and virtual mailboxes, remote mail scanning, and forwarding. UPS lists it as an Authorized Shipping Outlet inside PostalAnnex.

An offshore organization address, with the network and abuse contacts pointing to a mail-and-shipping storefront. That is the public registration trail.

These are different fields in the same registration chain, not evidence that BGP Tools invented an address. ARIN gives no mailbox or suite number, so the records do not establish which service Blatant uses or where its servers and staff operate. The addresses are accountability context; the scanning and malware-download records are the abuse evidence.

New ASN, existing address space

The registration date matters. RIPE RIS shows these prefixes moving from AS36680 to AS403005 in stages between late September and early October. AS36680 prefix history, AS403005 prefix history.

Older abuse attached to an IP can predate the current ASN. My local window starts after all nine prefixes had moved to AS403005. The cited public malware-download URLs were newly added or last observed online during its origin period, and the highlighted URLscan captures also occurred during that period.

Why AS403005 belongs on the watchlist

The evidence is enough for an operational decision:

• Directly observed TCP reconnaissance from multiple current prefixes.
• A clear 131-port sweep against one monitored endpoint.
• AbuseIPDB report histories in all nine blocks.
• Recent URLhaus malware-download records touching seven of nine prefixes.
• URLscan captures corroborating specific downloads from AS403005 servers.
• An existing Spamhaus ASN-DROP listing.

Spamhaus’s ASN-DROP classification applies to the autonomous system as a whole. My local observations and the recent public records give me additional reasons to keep it on the watchlist.

My recommendation: treat traffic from AS403005 as hostile and drop it at the edge.

Drop It Like It’s Hot.

Latest updates: ASN watchlist.