Internet Weather Report

AS401661, registered to EMBNEX, LLC and identified by ARIN as EMBNEX-AS, has been added to the ASN watchlist.

EMBNEX’s network is sending sustained hostile scanning traffic. The honeypot evidence, DShield, and AbuseIPDB all point to active scanner infrastructure.

The current IPv4 announcements are 16.5.0.0/24 and 198.89.99.0/24, totaling 512 addresses. BGP Tools also shows 2604:be0::/32; the traffic review below covers the two IPv4 blocks. Current prefix listing.

What the honeypot logs showed

In the seven days ending October 19, 2026 at 5:31 PM PT, honeypot logs recorded 949 events from 66 source IPs in 16.5.0.0/24: 921 TCP SYN events and 28 UDP events. All 949 were marked DROP. The traffic targeted 149 distinct destination port numbers across TCP and UDP.

The 30-day window, September 19–October 19 at the same cutoff, contained 85 source IPs from 16.5.0.0/24. The final 24 hours alone accounted for 627 events. No traffic from 198.89.99.0/24 appeared in that window.

Three addresses generated 832 of the 949 events—about 88%:

16.5.0.240 and 16.5.0.242 probed the same set of 34 TCP ports. The destination-port set included 22, 23, 2323, 37215, 8080, 8443, 34567, and 65001. The three addresses also accounted for 21 UDP events, all directed at port 9999. The remaining seven UDP events came from 16.5.0.234, using source and destination port 5060.

Across 65 TCP source IPs, all 921 TCP SYN events shared a TTL of 253 and a TCP window of 65535, with source ports within 61000–61255. The top three used the narrower range 61001–61255.

The repeated probes, identical port lists, and uniform packet profile across dozens of source addresses show an automated scanning operation. This is sustained hostile reconnaissance.

DShield sees it too

SANS Internet Storm Center’s DShield Recommended Block List, updated October 19 at 23:45 UTC, included 16.5.0.0/24 among its top 20 attacking /24 networks. The entry showed 303 targets reporting scans during the preceding three days.

Its separate daily-source feed, updated October 19 at 04:04 UTC, listed 88 source IPs from that /24, with 47,526 reports across 107 destination ports. Feed definitions.

AbuseIPDB: both blocks have report histories

The October 19 AbuseIPDB block-page snapshots showed 63,321 historical reports across 363 IPs:

The block totals include report histories that may predate EMBNEX’s origination. The current scanning evidence is more direct: all three busiest honeypot sources had 100% AbuseIPDB abuse-confidence scores.

Their individual pages showed 1,710 reports from 557 sources for 16.5.0.240, 1,974 reports from 538 sources for 16.5.0.241, and 1,884 reports from 572 sources for 16.5.0.242.

Routing and attribution

ARIN registered AS401661 on April 14, 2025. RIPE RIS first shows it originating 198.89.99.0/24 on August 6, 2026 and 16.5.0.0/24 on August 8, 2026. Both were current and RPKI-valid for AS401661 during the October 19 review. The October attacks occurred while AS401661 was originating the source block. RIPEstat, BGP Tools.

EMBNEX’s own Terms of Service prohibit port scanning and probing third-party systems. Its network is generating the very traffic that policy bans.

URLscan activity

The URLscan primary-ASN search returned 21 results during the review, including nine for 198.89.99.22:8080/. The October 18 capture carried clickfix and urlhaus submission tags. It returned HTTP 400 Bad Request, with a URLscan verdict of No classification.

Drop AS401661

Repeated hostile scans, dozens of attacking IPs, and independent corroboration from DShield and AbuseIPDB put this network on the watchlist. EMBNEX is carrying active scanner infrastructure.

Treat traffic from AS401661 as hostile and drop it at the edge.

Drop It Like It’s Hot.

Latest updates: ASN watchlist.