Executive Summary
Activity across monitored bulletproof hosting ASNs remained elevated this week, with several providers showing sustained scanning and attack traffic. The most significant activity came from Pfcloud UG (AS51396, PFCLOUD), which contributed over 2,500 honeypot events from 39 unique IPs — a diversified proxy and scanning operation spanning German and Dutch infrastructure. Kaopu Cloud HK (AS138915) dominated Sponge session counts with over 10,000 sessions from a dense cluster of 38.54.2.x IPs, though only minimal corresponding Honeylabs events were observed, suggesting their traffic targets specific networks rather than global scanning.
Infrastructure correlation analysis revealed that Pfcloud operates a fleet of identically-configured systems: multiple IPs share the same SSH HASSH fingerprint (e42184b06d45385a906f0803d04c83da) and identical OpenSSH 9.6p1 configurations, a hallmark of cloned provisioning. Meanwhile, Aeza Group (AS210644) continues to operate 3x-ui panel instances on port 2053, flagged by Censys ARC as THREAT-521 (security tool / proxy infrastructure).
Notable shifts include the re-emergence of Proton66 OOO (AS198953) as a significant player with 544 Honeylabs events and active port scanning targeting databases (6379/Redis, 1433/MSSQL), and Kprohost (AS214940) showing sustained but low-volume HTTPS probing from Ukrainian IPs. Several previously-tracked ASNs registered zero activity across all three data sources this week, suggesting possible infrastructure transitions.
By the Numbers
| ASN | Provider | IPs Observed | Events | Top Port | Change vs Prior Week |
|---|---|---|---|---|---|
| AS51396 | PFCLOUD | 39 | 2,511 | 25565/3128/8080 | First run |
| AS57043 | HOSTKEY-AS | 3 | 52 | 1000/9000 | First run |
| AS138915 | KAOPU-HK | 1 | 4 | 9030/6666/9092/11111 | First run |
| AS14956 | ROUTERHOSTING | 12 | 110 | 541/445/25565 | First run |
| AS198953 | PROTON66 | 4 | 544 | 6379/3389/1433 | First run |
| AS210644 | AEZA-AS | 3 | 19 | 80/4433 | First run |
| AS51852 | PLI-AS | 3 | 42 | 135/3389 | First run |
| AS214940 | KPRONET | 4 | 40 | 443 | First run |
| AS200651 | FLOKINET | 1 | 5 | 443/80 | First run |
| AS200593 | PROSPERO | 1 | 3 | 443 | First run |
| AS209847 | THE | ~20 | 0* | SSH/22 | First run |
| AS216246 | RU-AEZA-AS | ~20 | 0* | 8888/80/8080 | First run |
*Observed in Sponge session data but not in global honeypot events.
Top ASN Deep Dives
AS51396 (Pfcloud UG / PFCLOUD)
Pfcloud was the dominant source this week, generating 2,511 honeypot events from 39 unique IPs across German and Dutch hosting. The activity profile reveals a diversified operation: proxy services (ports 3128, 8080, 8888), Minecraft servers (25565), and web scanning. IP 45.135.193.193 alone accounted for 528 events, primarily targeting proxy ports.
Censys profiling shows 2,846 hosts in this ASN, all bearing the BULLETPROOF label. The software stack continues to be notable for heavy use of WireGuard (wg-easy on 775 hosts) alongside OpenSSH and Python/Flask (Werkzeug). The Pfcloud fleet shows strong infrastructure correlation: multiple IPs (176.65.149.x) share the exact same SSH HASSH fingerprint (e42184b06d45385a906f0803d04c83da) and identical OpenSSH 9.6p1 Ubuntu configurations, indicating automated provisioning of scanning infrastructure.
GreyNoise classifies several Pfcloud IPs as malicious or suspicious, with tags including Open Proxy Scanner, TLS/SSL Crawler, and SSH Connection Attempt.
AS198953 (Proton66 OOO)
As noted, Proton66 re-emerged as a significant new actor with 544 events from 4 IPs. IP 176.120.22.61 was the most active (396 events), targeting database ports (61433, 6433, 3005, 6000, 1433) in what appears to be an organized Redis/MSSQL scanning campaign. A separate IP (176.120.22.240) logged 133 events exclusively targeting Redis port 6379.
Censys shows no hosts for this ASN. The network block (176.120.22.0/24) was created in August 2024 and is registered to a St. Petersburg address.
AS14956 (RouterHosting LLC)
RouterHosting contributed 110 events from 12 US-based IPs. Activity was diverse: SMB scanning (port 445 from 45.61.129.23 and 172.86.119.189), SIP/VoIP probing (port 5060), Minecraft server discovery (25565), and port 541 (UBNT/airOS) scanning. IP 172.86.114.169 showed a concentrated burst of 39 events on July 27 targeting port 541.
Censys profiles 24,855 RouterHosting hosts (all BULLETPROOF-labeled) across a standard hosting stack: OpenSSH, nginx, Dovecot, and cPanel. A notable finding is the use of OpenSSH 9.9 (bleeding edge) on 172.86.114.169 — potentially a sign of proactive patching or fresh provisioning.
AS57043 (HOSTKEY B.V.)
HOSTKEY contributed 52 events from 3 IPs scanning ports 1000 and 9000. Activity originated from the Netherlands (Amsterdam) and Germany. The primary tooling was gSOAP/2.8 (SOAP-based scanning) targeting port 9000.
Censys shows 99,926 hosts in this ASN, making it one of the largest monitored providers. The software profile shows heavy OpenSSH (74,865 hosts) and nginx (58,010) usage, with notable presence of Ghost CMS, FastPanel, and cPanel. One IP (66.248.205.44) runs Nginx Proxy Manager with openresty and hosts multiple .uz domains (pandatv.uz, maxplay.uz, webox.uz, felixits.uz), suggesting shared hosting operations.
AS210644 (Aeza Group LLC)
Aeza Group logged 19 events from 3 IPs across Germany, Finland, and Sweden. The primary IP (138.124.51.186) probed honeypot HTTP services for VPN/remote-access portals, probing paths like /auth/login, /login, /dana-na/auth/url_default/welcome.cgi, /sslvpnLogin.html, /global-protect/login.esp, and /remote/login — targeting VPN appliances (Pulse Secure, GlobalProtect, Citrix).
Censys enrichment of 138.124.51.186 revealed a 3x-ui proxy panel on port 2053 (Censys THREAT-521, security_tool), confirming this IP is operating proxy/VPN infrastructure. It also runs SSH on port 22 (OpenSSH 8.2p1, an older version with known vulnerabilities including CVE-2023-38408). The IP scored “malicious” on the Censys reputation model and showed multiple unique TLS fingerprints per connection (different JA3 per HTTP request), a fingerprint-randomization technique.
Infrastructure Correlation
The most significant cross-ASN finding is the PFCLOUD fleet correlation. The shared SSH HASSH fingerprint (e42184b06d45385a906f0803d04c83da) across multiple 176.65.149.x IPs, combined with identical OpenSSH configuration parameters (same cipher preferences, MAC algorithms, and key exchange methods), strongly indicates these systems were provisioned from a common image or configuration management system. This is characteristic of organized scanning operations where infrastructure is spun up in batches.
The Pfcloud ECDSA host keys also share the same curve parameters (P-256 with identical generator and order values), though with unique public key points per host — standard practice for automated first-boot key generation.
Fleet Observations
Censys aggregations across monitored ASNs reveal:
- SSH exposure is near-universal: Port 22 is the most common open port across all ASNs except KPRONET (AS214940), which shows a Windows-centric profile (ports 139, 445, 3389, 5985).
- RouterHosting diversity: Largest spread of exposed services (SMTP, DNS, IMAP, POP3, RDP, SMB), suggesting a general-purpose hosting provider.
- Kaopu Cloud HK unique ports: Unusual high-port range (32080, 43080, 40003-40810) alongside standard web ports, possibly indicating custom application hosting or tunneling infrastructure.
IoCs and Detection Guidance
Notable indicators from this week’s monitoring:
IPs of Interest:
- 45.135.193.193 — PFCLOUD proxy scanning node, 528 events
- 176.120.22.61 — PROTON66 Redis/MSSQL scanner, 396 events
- 176.65.149.30/31/212/27 — PFCLOUD SSH fleet, identical HASSH
- 66.248.205.44 — HOSTKEY shared hosting, Nginx Proxy Manager
- 138.124.51.186 — AEZA 3x-ui proxy panel, Censys THREAT-521
- 154.90.37.55 — KAOPU-HK WinRM + SOCKS5 probing
- 172.86.114.169 — ROUTERHOSTING OpenSSH 9.9 node
Fingerprints:
- HASSH: e42184b06d45385a906f0803d04c83da — PFCLOUD fleet SSH configuration
- JA4H: po11nn0400_52fce913cf3b — KAOPU-HK WinRM client
- JA4: t13i1010h1_61a7ad8aa9b6_3a8073edd8ef — AEZA Chrome 147 TLS fingerprint
URL Paths Targeted:
- /wsman?PSVersion=5.1.19041.1 — WinRM probing
- /dana-na/auth/url_default/welcome.cgi — Pulse Secure VPN
- /global-protect/login.esp — Palo Alto GlobalProtect
- /sslvpnLogin.html — SSL VPN portal enumeration
- /guacamole/ — Apache Guacamole probing
- /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php — PHPUnit RCE
Full data (events, fingerprints, IP lists): https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-27/