The Costume Catalog: Nine Masks From One Foundry

TI-2026-082D · The Tripwire Ledger, Part D — The Finale Confidence: MEDIUM — the shared-provenance catalog is documented at HIGH; the framing of the un-caught tenants is deliberately held to watchlist, not conviction Classification: TLP:WHITE

What a catalog is for

The series began with a single unread log — the router's mikrotik-attack tripwire — and one incongruous entry: a scanner wearing a Ukrainian bank's name. Part B found its twin, a "British" vault. Part C found the thing they shared: EMBNEX, LLC (AS401661), a three-month-old US address broker whose one IPv6 /32 and carrier transit feed a downstream cone of at least nine small, differently-costumed autonomous systems.

This finale lays that cone out as what it is — a catalog of costumes — and does the one thing a catalog is good for: it lets you recognise the next mask before it does anything, because you have already seen the wardrobe it came from. It also does the thing a responsible catalog must: it draws a bright line between the two entries we have caught and the seven we have only found, and it refuses to blur them. A watchlist that pretends to be a charge sheet is worse than useless; it launders suspicion into false certainty. So this is a watchlist, labelled as one, and the label is load-bearing.

The nine masks

Every entry below shares one thing and only one thing that matters: it sits in the EMBNEX (AS401661) downstream cone, most drawing a /48 from 2604:be0::/32. Everything else — the name, the flag, the story — is paint.

Nine names. A bank, a vault, an East-Coast host, and a run of six near-identical Brazilian "LTDA" clouds. Read as a list of companies, it is noise. Read as a catalog from one foundry, the pattern is loud: the same recipe, printed nine ways.

The recipe, printed nine ways

Hold the entries side by side and the template resolves. Every costume is cut to the same three measurements.

A clean, plausible, regional brand. Not a random string — a reassuring one. "BANK." "VAULT." "EastCoast." "Meteor Cloud." Names chosen to survive a glance: to read as ordinary infrastructure and earn the half-second of benefit-of-the-doubt that automated blocklists and tired analysts extend to anything that sounds like a business. The Brazilian cluster leans on the quiet respectability of a "LTDA" — a limited company, filed and boring.

A uniform hosting facade. Every sampled tenant IP returns the same AbuseIPDB usage type — Data Center / Web Hosting / Transit — under its clean brand. Whatever the name promises (banking, a vault, a cloud), the network underneath is the same undifferentiated hosting substrate. The product is identical; only the label changes.

At least one laundered coordinate. The disguise always includes a mismatch between where the entity claims to be and where its addresses are. VASH KREDIT is a UA name with AE registration and DE-geolocating IPs. VPSVAULT is a GB name with SC registration and US IPs. EastCoastHost evokes the US and geolocates to Canada. Yellow Connect is a BR company announcing a prefix that lands in Bulgaria. No single mismatch is proof of anything — geolocation is imperfect, companies incorporate abroad — but nine entities each carrying the same kind of mismatch is not nine coincidences. It is a template with a laundering step built in.

And then, on one entry, the template shows its hand completely.

The tell: a mask beneath the mask

AS210554 does not stop at one costume. Its prefixes announce under three different retail brands at once: 151.244.40.0/24 presents as Meteor Cloud LTDA, 45.157.16.0/24 as FantasyHost, and 82.38.28.0/24 as StreetHosting LTDA. One autonomous system, three storefronts, simultaneously.

This is the single most clarifying fact in the catalog, because it proves the costume layer is finer-grained than the ASN — that the operator treats brand identity as a per-prefix disposable, not a per-company fact. If a single ASN will wear three brands at once, then the boundary between "nine companies" and "one operation with nine labels" is exactly as thin as the series has argued. A catalogue that keys on holder names doesn't just miss the shared root; it actively over-counts the operators — filing one multi-brand ASN as three separate hosts — while under-counting the foundry that stamps them all. The names are not the entities. The provenance is.

The line we do not cross

Now the discipline, because everything above could tip into overreach if left unguarded.

Two of these nine have attacked this estate. Seven have not. AS209630 and AS215925 account, between them, for every EMBNEX-origin event our sensors have ever recorded: sixteen IPs on the router tripwire, and nothing on the honeypot or the web edge. The other seven — EastCoastHost, Meteor/FantasyHost/StreetHosting, Yellow Connect, Blazehosting, Season Cloud, ELGAE, BLS — have no footprint here whatsoever, and the addresses we sampled from their ranges carried no meaningful abuse reputation at the time of writing.

That distinction is not a hedge; it is the finding. The seven are on this page for exactly one reason — they were minted at the same foundry as the two that attacked us — and that is a legitimate reason to watch them and an illegitimate reason to condemn them. A broker can serve honest customers alongside hostile ones; a shared /32 parent is a strong prior, not a verdict. The correct operational posture toward Blazehosting or Season Cloud today is not "block," and it is certainly not "these are attackers." It is: "if a probe ever arrives wearing this brand, read it against its EMBNEX provenance and do not extend it the clean-name benefit-of-the-doubt the template was designed to steal." Suspicion, named and bounded. Not conviction.

Why the catalog is worth keeping

If seven of nine have done nothing to us, why document them at all? Because the two that did have already paid for the list.

They proved three things the catalog now inherits, for free, about every other entry: that this foundry's output does get pointed at us; that it arrives low and slow, at the perimeter, invisible to every sensor but the tripwire; and that it wears whatever brand is convenient while doing so. A future probe from ELGAE Datacenter or BLS Services therefore does not arrive as a stranger. It arrives as the tenth costume from a wardrobe two of whose garments we have already caught red-handed. The catalog converts nine independent unknowns into one known pattern with nine faces — and pattern is the only thing that scales against an adversary whose entire design is to present a fresh, clean, unrelated identity every time.

Concretely, the catalog earns its keep as a provenance key. Group perimeter events not by the holder string the attacker chose, but by the parent block and cone the attacker could not choose: 2604:be0::/32, AS401661 downstream. On that axis, the disguise simply stops working — the nine masks fall into one bin, and the next mask falls into it too, the moment it routes a packet.

The translation, for everybody

Across this series you caught two burglars at your alarmed back panel — one with BANK on his van, one with VPS VAULT — and traced both vans to the same rental yard. Part C was the yard. This is the yard's catalog: the full row of vans it rents out.

There are nine of them parked there. Besides the two you caught, there's one painted "East Coast," and a whole run of look-alikes with Brazilian company names. One of the vans, when you look closely, has three different company names painted over each other — the yard doesn't even bother giving each van its own identity; it just paints on whatever's handy that morning.

Here's the honest part, and it matters. Seven of these nine vans, you have never seen do anything wrong. They might belong to perfectly ordinary movers. So you don't accuse them, and you don't clamp them. What you do is write down the whole row — because you now know this particular yard rents to people who case houses, that they come at your back panel quietly, and that they'll repaint a van overnight. So the next time any van rolls up with plates from that yard — no matter what's freshly painted on the side — you don't wave it through on the strength of a nice name. You note where it came from, and you keep one eye on it. You will never memorise the paint. You only ever needed the address of the yard.

The Tripwire Ledger — complete

Four parts, from one line in a log the network was throwing away. A bank that wasn't, a vault that was borrowed, the foundry that minted them, and the catalog of costumes it keeps in stock. The two scanners were never the story; they were the two threads long enough to pull. What they unravelled is the shape of a whole class of adversary — fresh, costumed, brokered, and aimed at the layer your dashboards don't watch — and the one durable handle on it: not the name it wears, but the wardrobe it came from.

The Tripwire Ledger — complete. Read the quiet log; look past the paint; watch the yard, not the vans.

The series

Cross-references

• TI-2026-082C — The Address Foundry — EMBNEX, the shared broker root of the catalog.
• TI-2026-082A / 082B — the two catalog entries proven hostile against this estate.
• TI-2026-066E — The Bulletproof Midtier — reading laundered hosting by routing/provenance rather than registration.

This dossier documents a shared-provenance tenant catalog for defensive purposes and as a watchlist. Only AS209630 and AS215925 are attributed hostile activity against this estate; the remaining tenants are listed solely on the basis of shared EMBNEX provenance and are expressly not asserted to be malicious. No individual is named. Brand and company names are treated as network identities; where legitimate businesses of similar names exist, no association is implied. TLP:WHITE.