Bulletproof Hosting Watch: Week of 2026-07-13

Executive Summary

Activity across the 26 monitored bulletproof hosting ASNs expanded significantly this week, with 15 ASNs showing observable sessions (up from 9 last week, a 67% increase). The most dramatic developments come from two providers that were barely blips on the radar seven days ago: Prospero Ooo (AS200593) surged from 2 events to 3,890 events from a single IP, and Proton66 OOO (AS198953) expanded from focused RDP credential stuffing to full multi-protocol bruteforcing across RDP, SSH, Telnet, and FTP.

Pfcloud UG (AS51396) remains the volume leader with 10,000+ events, but the character of its activity shifted. A coordinated scan cluster of three IPs in the 204.76.203.0/24 range — .78, .79, and .80 — launched simultaneously on July 11 at 03:24:10 UTC and ceased in unison at 13:26:10 UTC, a ten-hour synchronized window suggesting orchestrated deployment rather than independent actors.

Two new entrants deserve attention. Datashield Inc. (AS211720), registered in the Seychelles, appeared for the first time conducting Exchange /ews/ endpoint reconnaissance. ZhouyiSat Communications (AS400992) was observed scanning for /.env files — a direct attempt to steal application credentials from misconfigured web servers. Both patterns are targeted intrusion precursors, not opportunistic scanning.

Fingerprint collection improved substantially this week. Eleven unique fingerprints were captured across HASSH, JA4/JA3, and JA4H — a significant upgrade from zero fingerprints last week, enabling future correlation and detection of recurring infrastructure.

By the Numbers

Top ASN Deep Dives

AS51396 (Pfcloud UG)

Pfcloud maintains its position as the most operationally active bulletproof provider, with 10,000+ honeypot events this week. The activity profile shifted from last week’s broad distribution across many IPs to a coordinated scan cluster of three IPs in the 204.76.203.0/24 range:

• 204.76.203.79 — 992 events, targeting ports 8801, 10800, 8868, 8003, 6250
• 204.76.203.80 — 950 events, targeting ports 2052, 10050, 7000, 10280, 8119
• 204.76.203.78 — 926 events, targeting ports 7780, 9057, 5228, 10031, 888

All three IPs began scanning at 2026-07-11T03:24:10 UTC and ceased at 2026-07-11T13:26:10 UTC — a precise ten-hour synchronized window. This is not independent scanning; it is a coordinated deployment, likely from a single controller provisioning three nodes with distinct scan profiles.

The veteran Pfcloud IP 176.65.148.25 generated 2,600 events over four days (Jul 8-11), targeting ports 4441, 33998, 6002, 35389, 5005. Censys enrichment confirms this IP runs OpenSSH 9.2p1 and is classified as malicious by GreyNoise — an RDP crawler and bruteforcer.

A German Pfcloud IP, 45.135.193.193, produced 463 events across the full week targeting proxy-style ports (8888, 8081, 8080, 443, 81).

Censys shows 3,176 Pfcloud hosts carrying the BULLETPROOF label. Software aggregation reveals Python (120 hosts), Werkzeug (80), wg-easy (45), OpenSSH (30), and nginx (25) — a profile suggesting VPN/proxy infrastructure with web management interfaces.

AS200593 (Prospero Ooo)

Prospero’s surge is the most statistically dramatic change this week. A single IP, 91.202.233.79 (Turkmenistan), generated 3,890 events in a 12-hour window on July 10, targeting a wide distribution of high ports: 43128, 12063, 49326, 19168, 13230. Censys shows no exposed services on this IP — it is scan-only infrastructure, likely a ephemeral VM or container spun up for a single campaign.

This pattern — high volume from a single IP, diverse high ports, no services exposed in return — is consistent with a cloud-hosted scanning appliance deployed for a time-limited engagement. The Turkmenistan geolocation is unusual; most bulletproof providers cluster in NL, US, RU, or CH. Prospero may be routing through TM for evasion or may have TM-registered infrastructure.

AS198953 (Proton66 OOO)

Proton66 underwent a significant behavioral expansion this week. Last week’s profile was RDP-only credential stuffing from Moscow IPs using mstshash=Domain cookies. This week, the primary actor 176.120.22.240 generated 429 events across four protocols: RDP (port 4000, 3389), SSH (port 22), Telnet (port 23), and FTP (port 21). Censys enrichment confirms this IP is classified as malicious by GreyNoise as a multi-protocol bruteforcer.

A second IP, 176.120.22.147, produced 89 events targeting ports 44463, 44412, 44400 (non-standard RDP variants), 80, and 8080. A third IP, 37.77.150.67, hit port 1433 (MSSQL) 21 times on July 10 — a database bruteforcing attempt.

The expansion from single-protocol RDP to multi-protocol bruteforcing suggests Proton66 has either upgraded its tooling or is hosting a different customer this week. The mstshash=Domain RDP cookie pattern persists, maintaining the detection signature.

AS51852 (Private Layer INC)

Private Layer (Switzerland) nearly doubled its event volume to 1,802 events. The primary actor, 179.43.134.114, generated 1,518 events on July 8-9 targeting a diverse set of ports: 5430, 64312, 1315, 1089, 3333. Censys confirms this IP runs OpenSSH 8.9p1 on Ubuntu and responds to the hostname hostedby.privatelayer.com.

Three additional IPs appeared: 179.43.168.58 (252 events on port 443), 179.43.186.241 (22 events on ports 443 and 8291), and 179.43.185.147 (5 events on port 5985/WinRM).

The WinRM targeting on 179.43.185.147 is notable — port 5985 is PowerShell remoting, a post-exploitation lateral movement vector. This may indicate that Private Layer infrastructure is being used for follow-on access after initial compromise elsewhere.

AS14956 (RouterHosting LLC)

RouterHosting’s volume decreased 23% to 206 events, but the diversity of its activity increased. The top IP, 216.126.239.17, generated 94 events across the full week (Jul 5-11) targeting unusual ports: 5555, 12124, 2930, 8889, 1212. Censys enrichment reveals this IP is classified as suspicious by GreyNoise and has been observed scanning for Wordpress, CrushFTP, Ivanti, and OWA vulnerabilities — a multi-CVE exploit toolkit.

New IPs appeared this week: 144.172.103.227 (34 events on HTTP ports 80/8080/443), 216.126.225.168 (33 events on 443/8080/80), 144.172.97.10 (6 events on port 5060/SIP), and 167.88.165.96 (5 events on port 8317). The SIP scanning on 144.172.97.10 is a continuation of RouterHosting’s VoIP reconnaissance from prior weeks.

AS214940 (Kprohost LLC)

Kprohost (Ukraine) maintained its signature pattern: low-volume HTTPS scanning from the 77.83.39.x range, but with a distinctive user agent rotation across 20 different browser strings. Top IPs: 77.83.39.197 (26 events), 77.83.39.119 (11 events, new this week), and 77.83.39.94 (6 events, new this week).

The UA rotation includes ancient and obscure browsers (Epiphany, QupZilla, Arora, Links) alongside modern Chrome/Firefox variants — deliberate evasion to avoid UA-based blocking. Censys shows only 167 hosts in this ASN, but the service profile is heavily Windows-oriented: 3389/RDP (103), 5985/WinRM (101), 135/RPC (100), 139/NetBIOS (97), 445/SMB (97), 47001 (95).

New Entrants

AS211720 (Datashield Inc.)

First observed this week. A single IP, 185.231.33.46, registered in the Seychelles, generated 4 events on July 10 targeting port 443. The hostname resolves to “short-tan-rat”. The activity is Exchange Web Services reconnaissance: HTTP HEAD requests to /ews/ with a distinctive TLS 1.3 fingerprint (JA4: t13i1813h1, JA3: 60eb467937ec).

Exchange /ews/ probing is a precursor to CVE-2021-26855 (ProxyLogon) and related Exchange exploitation. The Seychelles registration and the “short-tan-rat” hostname pattern suggest deliberate anonymity infrastructure. This is targeted reconnaissance, not opportunistic scanning.

AS400992 (ZhouyiSat Communications)

185.228.72.109 was observed making HTTP GET requests to /.env — a direct attempt to retrieve environment configuration files containing database credentials, API keys, and application secrets. The TLS fingerprint (JA4: t13i1711h1) and JA4H fingerprint (ge11nn0500_2d30dc89d981) are now catalogued for future detection.

Censys enrichment reveals this IP hosts a self-signed TLS certificate issued by “WIN-8FIH4EGN4AL” on hostname “usa.unlimitedteam.space” — a Windows machine name suggesting a compromised or misconfigured Windows server being used as scanning infrastructure.

AS57043 (Hostkey B.v.) and AS216139 (Iron Hosting Centre)

Both appeared with minimal activity (1-2 SSH scanning events each). Hostkey’s IP 151.243.173.235 uses libssh 0.9.6 (HASSH: f555226df1963d1d3c09daf865abdc9a), a library commonly embedded in scanning tools rather than interactive SSH clients. Iron Hosting’s 178.208.88.28 hit port 22 twice. These are likely initial probes that may escalate in future weeks.

AS138915 (KAOPU-HK)

KAOPU-HK generated 10,000 Sponge sessions (NTP on port 123) but zero Honeylabs events. The NTP traffic is notable for its volume but is not attack traffic. However, the prior week’s report noted unusual port exposure on non-standard high ports (32080, 43080) and a broad Windows management surface. The NTP volume may be cover traffic or legitimate time sync from a large VPS fleet.

Tor Exit Node Activity

185.100.87.136 (FlokiNET, Romania) is a confirmed Tor exit node running Tor 0.4.9.11 on port 9001, hostname “PremiumTorExit”. This IP generated 17 honeypot events scanning ports 80, 443, 444, 8080, and 22.

Tor exit nodes scanning honeypots creates an attribution problem: the traffic may originate from the exit node operator or from a Tor user routing through it. The “PremiumTorExit” naming and the scanning of diverse ports suggests the operator is actively running scanning tools through their own exit node, using Tor as an anonymity layer rather than providing a public service.

A HASSH fingerprint (e54ef3ec27fe1fea7ab64d3fa05359fd, SSH-2.0-OpenSSH_10.1) was captured from this IP, enabling future correlation if the same fingerprint appears from non-Tor infrastructure.

Infrastructure Correlation

All monitored ASNs carry the BULLETPROOF label in Censys across every observable host. Key cross-provider observations:

Coordinated Scan Clusters: The 204.76.203.78/79/80 Pfcloud cluster with synchronized start/stop times is the clearest evidence of orchestrated scanning infrastructure this week. Fleet correlation analysis identified identical timestamps across all three IPs, confirming a single controller.

Multi-Protocol Bruteforce Expansion: Proton66’s expansion from RDP-only to RDP+SSH+Telnet+FTP is a significant capability upgrade. GreyNoise’s “malicious” classification for 176.120.22.240 confirms this is known active threat infrastructure.

Targeted Reconnaissance Patterns: Datashield’s Exchange /ews/ probing and ZhouyiSat’s /.env scanning represent a shift from opportunistic scanning to targeted intrusion precursors. Both patterns are associated with specific CVE exploitation chains.

Self-Signed Certificate Correlation: ZhouyiSat’s 185.228.72.109 uses a self-signed cert from “WIN-8FIH4EGN4AL” — a Windows machine name. This suggests a compromised Windows server being repurposed as scanning infrastructure, a pattern seen in bulletproof hosting where providers offer “clean” Windows VPS images that customers can deploy for scanning operations.

IoCs and Detection Guidance

Notable Source IPs

# Pfcloud UG (AS51396) -- Netherlands
204.76.203.78      -- coordinated scan cluster (synchronized with .79/.80)
204.76.203.79      -- coordinated scan cluster
204.76.203.80      -- coordinated scan cluster
176.65.148.25      -- GreyNoise malicious, RDP crawler/bruteforcer (OpenSSH 9.2p1)
45.135.193.193     -- German proxy scanning (active entire week)

# Prospero Ooo (AS200593) -- Turkmenistan
91.202.233.79      -- 3890 events, scan-only, no exposed services

# Private Layer INC (AS51852) -- Switzerland
179.43.134.114     -- 1518 events, diverse ports (OpenSSH 8.9p1)
179.43.185.147     -- WinRM/5985 targeting

# Proton66 OOO (AS198953) -- Russia
176.120.22.240     -- GreyNoise malicious, multi-protocol bruteforcer
176.120.22.147     -- non-standard RDP variants (44463/44412/44400)
37.77.150.67       -- MSSQL/1433 bruteforcing

# RouterHosting LLC (AS14956) -- US
216.126.239.17     -- GreyNoise suspicious, multi-CVE scanner
144.172.97.10      -- SIP/5060 scanning
167.88.165.96      -- port 8317 scanning

# Datashield Inc. (AS211720) -- Seychelles
185.231.33.46      -- Exchange /ews/ recon (hostname: short-tan-rat)

# ZhouyiSat Communications (AS400992) -- US
185.228.72.109     -- /.env scanning (self-signed cert, usa.unlimitedteam.space)

# FlokiNET ehf (AS200651) -- Romania
185.100.87.136     -- Tor exit node, active HTTP/SSH scanning (Tor 0.4.9.11)

Notable Fingerprints

# HASSH SSH Fingerprints
f555226df1963d1d3c09daf865abdc9a  -- libssh_0.9.6 (Hostkey, SSH scanning)
e54ef3ec27fe1fea7ab64d3fa05359fd  -- OpenSSH_10.1 (FlokiNET Tor exit node)

# JA4/JA3 TLS Fingerprints
t13i1711h1_ab0a1bf427ad_882d495ac381  -- ZhouyiSat .env scanning
t13i1909h2_9dc949149365_97f8aa674fd9  -- FlokiNET transparentpix.gif probing
t13i1813h1_5103eae14fdb_97a66a8f4cb1  -- Datashield Exchange /ews/ recon

# JA4H HTTP Fingerprints
ge11nn0500_2d30dc89d981  -- HTTP GET /.env (ZhouyiSat)
ge11nn0400_88d30a62b7ad  -- HTTP GET port 444 (FlokiNET Tor)
he11nn0500_2d30dc89d981  -- HTTP HEAD /ews/ (Datashield)

Notable Target Ports

4441/33998/6002/35389/5005  -- Pfcloud diverse port scanning
43128/12063/49326/19168     -- Prospero high-port scan bomb
4000/1723/143/8080/111     -- Proton66 multi-protocol bruteforce
5985                        -- WinRM targeting (Private Layer)
8317                        -- Unusual port (RouterHosting)
44463/44412/44400           -- Non-standard RDP variants (Proton66)

Detection Rules

1. Coordinated scan cluster: Alert when 3+ IPs in the same /24 start scanning within 1 second of each other and cease within 1 second of each other — Pfcloud 204.76.203.78/79/80 pattern
2. Multi-protocol bruteforce: Flag single IPs hitting 4+ distinct protocol ports (SSH/22, RDP/3389, Telnet/23, FTP/21) within 24 hours — Proton66 pattern
3. /.env file access: Alert on any HTTP GET to /.env from non-internal IPs — ZhouyiSat pattern
4. Exchange /ews/ recon: Alert on HTTP HEAD to /ews/ from non-corporate IP ranges — Datashield pattern
5. Tor exit node scanning: Flag Tor exit node IPs (per public lists) generating 10+ honeypot events in 24 hours — FlokiNET pattern
6. Single-IP scan bomb: Alert when one IP generates 1000+ events in 12 hours with no exposed services in return — Prospero pattern
7. WinRM from bulletproof ASNs: Block port 5985 access from Swiss IP ranges associated with Private Layer INC

Full data for this week: kevlar/2026-07-13