Executive Summary
PROTON66 (AS198953) showed the largest change this week. Its MSSQL-TDS brute-force campaign grew 594% to about 1,700 honeypot events. One source IP, 176.120.22.61, swept 289 distinct ports. The host runs Windows Server 2012 R2 with exposed DCE/RPC and NetBIOS services. This host is likely compromised or run by a moron.
FLOKINET (AS200651) produced a new command-and-control artifact. The Tor exit relay 185.100.87.136 sent beacon requests to POST /api/client/update with a “SPARK COMMIT” user agent. The requests carried a commit hash and a secret header. This is a C2 callback pattern.
KPRONET (AS214940) resumed its .git and .env exfiltration campaign. The sources were 77.83.39.6 and 77.83.39.94. Both hosts rotated user agents and requested /.env and /.git/HEAD over TLS on port 443. Censys attributes the 77.83.39.0/24 block to PFCLOUD. Honeylabs attributes the events to KPRONET. One of the two data sources is stale.
PFCLOUD (AS51396) remains the most active provider in the monitored set. The proxy fleet in 204.76.203.0/24 expanded. Two nodes, 204.76.203.224 and .226, share identical ClickHouse and proxy banner hashes. This confirms cloned infrastructure.
By the Numbers
| ASN | Provider | Sponge Sessions | Honeylabs Events | Top Port | Change vs Prior Week |
|---|---|---|---|---|---|
| AS138915 | KAOPU-HK | 10,000+ (capped) | 1 | 123 (NTP) | steady |
| AS51396 | PFCLOUD | 10,000+ (capped) | ~11,500 | 22 (SSH) | ~0% |
| AS51852 | PLI-AS | 1,215 | ~107 | 135 (DCE/RPC) | -25% |
| AS198953 | PROTON66 | 1,080 | ~1,700 | 3005 | +594% |
| AS14956 | ROUTERHOSTING | 317 | ~130 | 80 (HTTP) | -37% |
| AS57043 | HOSTKEY-AS | 29 | 4 | 2000 | new |
| AS400992 | ZHOUYISAT | 157 | 0 | 443 | — |
| AS214940 | KPRONET | 89 | ~16 | 80 | +78% |
| AS210644 | AEZA-AS | 72 | ~90 | 5000 | new |
| AS209847 | THE | 60 | 0 | 3389 (RDP) | -100% |
| AS200651 | FLOKINET | 37 | ~8 | 443 | +33% |
| AS30823 | AUROLOGIC | 5 | 0 | 5060 (SIP) | — |
| AS200593 | PROSPERO-AS | 2 | 0 | 443 | — |
| Others (12 ASNs) | Various | 0 | 0 | — | — |
“Others” includes 12 ASNs with zero Sponge and zero Honeylabs activity.
Top ASN Deep Dives
AS198953 (PROTON66 OOO)
PROTON66 expanded its MSSQL-TDS brute-force campaign. The source IP 176.120.22.61 generated 1,664 events. It swept 289 distinct ports. The ports include 1433, 1434, 1435, 1500, 2008, 2433, 2468, 3005, 4433, 6000, 7788, 9433, 10433, 11433, 14333, 15433, 17433, 19433, 20433, 31433, 33000, and 37628. The attacker scans for SQL Server instances on non-default ports.
Censys shows 176.120.22.61 is a Windows Server 2012 R2 host. It exposes DCE/RPC on port 135 and NetBIOS on port 137. Its RDP login screen is in Russian. The self-signed RDP certificate uses the common name M051108. A second IP, 176.120.22.240, probed RDP port 3389 and Redis ports 6379 and 6380.
The campaign appears automated. The TDS pre-login packets are identical across all ports. The host itself is exposed to the same brute-force it performs. This profile fits a compromised jump box.
AS51396 (PFCLOUD / Pfcloud UG)
PFCLOUD generated about 11,500 honeypot events. The proxy fleet in 204.76.203.0/24 expanded. The nodes 204.76.203.224, .225, and .226 each generated more than 2,000 events. The nodes 204.76.203.73 and .7 added 2,029 and 970 events.
The nodes 204.76.203.224 and .226 run identical services. Both expose a ClickHouse web UI on port 9009. Both run a paid proxy on port 9191. The proxy returns HTTP 407 “Proxy Authentication Required”. The error body says “your plan expired”. The ClickHouse and proxy banner hashes are identical on both nodes. This is cloned infrastructure.
The IP 204.76.203.224 swept 1,182 distinct ports in its lifetime. Honeylabs labels it an unrecognized scanner. The IP also runs a Minecraft server on port 25565 with the MOTD “Z”.
The proxy checker 45.135.193.193 continued its CONNECT validation against httpbin.org:443. The checker 45.135.194.113 queried the proxy-judge endpoint at proxy.flarevpn.digital:8080/judge. The node 204.76.203.49 probed SOCKS5 ports 1080 through 10809 and Tor ports 9050 and 9051.
The IP 77.83.39.6 carries the HASSH fingerprint 41ff3ecd1458b0bf86e1b4891636213e. Last week’s report tied this same fingerprint to the PFCLOUD clone pair 204.76.203.221 and .214. This week, 77.83.39.6 performed the /.env exfiltration. The data sources disagree on its owner. Honeylabs says KPRONET (AS214940). Censys says PFCLOUD (AS51396).
AS51852 (PLI-AS / Private Layer INC)
PLI-AS generated about 107 events, down 25% from the prior week. The .env exfiltration continues from 179.43.150.26. The host requested /.env, /z501, /.e3868, /s/5845, and /api/trpc/setup.setup. Honeylabs gave it a high-confidence malicious verdict with 47 exploit-path hits.
The IP 81.17.28.131 became the most active source with 69 events. It probed DCE/RPC on port 135 and HTTP on ports 8899 and 8089. The IP 179.43.185.147 ran WinRM brute-force against POST /wsman. The IP 179.43.175.56 probed the Docker API on port 2375 with GET /version. The IP 179.43.146.27 probed MSSQL port 1433 and web ports 9000, 20443, and 4433.
Censys shows 8,542 hosts for this ASN. Port 161 (SNMP) is exposed on 3,413 hosts. This is the largest SNMP exposure in the monitored set. The fleet runs nginx, Dovecot, Exim, cPanel, and OpenVPN Access Server.
AS14956 (ROUTERHOSTING / RouterHosting LLC)
RouterHosting event volume fell 37% to about 130 events. The PPTP brute-force campaign ended. PPTP port 1723 saw only one event this week. A new SMBv1 pattern appeared. The IPs 172.86.91.225, 172.86.89.13, and 172.86.119.138 probed port 445 with SMBv1 and SMB2 packets.
The IP 144.172.104.239 probed Minecraft port 25565. The IPs 216.126.224.182 and 107.189.17.174 probed SIP ports 5060 and 5061. The IP 144.172.99.148 probed Elasticsearch port 9200. The IP 167.88.168.121 tested SOCKS5 on 1080 and other service ports.
Censys shows 24,964 hosts, all labeled BULLETPROOF. The fleet is mixed Linux and Windows. Windows hosts expose RDP on 3389, WinRM on 5985, and port 47001. Certificates include YE1/YE2/YR1/YR2 and DC-named certificates like windows-Dallas0 and windows-Utah-4g.
AS214940 (KPRONET / Kprohost LLC)
KPRONET resumed its exfiltration campaign. The IP 77.83.39.6 requested /.env on port 443 many times. It rotated user agents across each request. The user agents included Symbian, Opera Presto, QQBrowser, and Android browsers. The IP 77.83.39.94 requested /.git/HEAD.
Honeylabs gave 77.83.39.6 a high-confidence malicious verdict. The host registered 25 exploit-path hits. Censys shows zero hosts for AS214940. The 77.83.39.0/24 block now belongs to PFCLOUD in Censys data. The IP space may have moved between providers.
AS200651 (FLOKINET ehf)
FLOKINET produced the week’s clearest C2 artifact. The IP 185.100.87.136 sent a POST to /api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows. The user agent was SPARK COMMIT: 08059e95.... The request carried the secret header 3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2.
The same IP requested /eventmanager, /ajax, /api/v1/update, and /FD873AC4-CF86-4FED-84EC-4BD59C6F17A7. It also fetched /images/transparentpix.gif. These paths fit an agent beaconing loop. The HASSH fingerprint e54ef3ec27fe1fea7ab64d3fa05359fd appeared on this IP.
Censys confirms 185.100.87.136 is a Tor exit relay. The relay nickname is PremiumTorExit. It runs Tor 0.4.9.11 and exits on ports 80, 443, 53, and 1194. Its TLS port 9001 presents a certificate for www.ic65jfkrs.net, issued by www.jqfbaj7qyl35.com. The certificate is valid for only 14 days. The domain pair looks random.
Infrastructure Correlation
The PFCLOUD proxy fleet is cloned and expanding. The nodes 204.76.203.224 and .226 share identical ClickHouse and proxy banner hashes. The 204.76.203.0/24 block belongs to Intelligence Hosting LLC, a Pfcloud affiliate.
The HASSH fingerprint 41ff3ecd1458b0bf86e1b4891636213e spans the PFCLOUD fleet. It appeared on the clone pair 204.76.203.221 and .214 last week. It appeared on 77.83.39.6 this week. The .env crawler shares the base image with the proxy fleet.
The Xray panel certificate series spans five providers. The certificate common names YE1, YE2, YR1, and YR2 appear across HOSTKEY, ROUTERHOSTING, PFCLOUD, PLI-AS, and KAOPU-HK. Combined counts exceed 70,000 certificates. The issuer names XUI.one and Gozargah appear on PFCLOUD. These names identify X-UI proxy panels. The operators run a shared panel toolchain.
KAOPU-HK runs a scan-only node pool. The 154.93.119.0/24 block presents a single HTTP service on port 4083. The service returns 404 on every path. The nodes carry the BULLETPROOF label. The block was created in January 2026.
Fleet Observations
- HOSTKEY remains the largest fleet at 101,028 Censys hosts. Port 22 is open on 76,822 of them.
- AEZA hosts 72,465 Censys hosts. Port 1080 (SOCKS) is open on 832 of them.
- PLI-AS exposes SNMP on 3,413 of 8,542 hosts.
- KPRONET has zero Censys-visible hosts. The ASN may be de-provisioning.
- KAOPU-HK runs a custom openresty and tengine web stack. Squid proxies and OpenVPN Access Server are present.
- ROUTERHOSTING runs AnyDesk client certificates on 288 hosts. This is a remote-management signal.
- PROTON66 hosts are Windows-heavy. RDP and WinRM dominate its service profile.
IoCs and Detection Guidance
Notable IPs (with Censys enrichment):
- 176.120.22.61 — PROTON66 MSSQL-TDS brute, 289 ports, exposed DCERPC/NetBIOS, Windows 2012 R2
- 204.76.203.224 — PFCLOUD proxy node, ClickHouse 9009 + proxy 9191, 1,182-port sweep
- 204.76.203.226 — PFCLOUD clone of .224, identical banners
- 204.76.203.225 — PFCLOUD proxy node, 2,053 events
- 77.83.39.6 — .env exfil, UA rotation, HASSH 41ff3ecd, high-confidence malicious
- 77.83.39.94 — .git/HEAD exfil
- 185.100.87.136 — FLOKINET Tor exit + SPARK C2 beacon
- 179.43.150.26 — PLI-AS .env exfil, 47 exploit-path hits
- 81.17.28.131 — PLI-AS DCE/RPC + web probing, 69 events
- 172.86.91.225 — ROUTERHOSTING SMBv1 brute on 445
- 77.110.106.52 — AEZA qBittorrent peer scan on 16663
- 154.93.53.239 — KAOPU WinRM /wsman probe
Fingerprints:
- HASSH
41ff3ecd1458b0bf86e1b4891636213e— PFCLOUD cloned fleet + .env crawler - HASSH
e54ef3ec27fe1fea7ab64d3fa05359fd— FLOKINET SPARK C2 client - JA4
t13i190800_9dc949149365_97f8aa674fd9— KPRONET .env UA rotator - JA4
t13i251000_b78ed14e2fd0_ab7e3b40a677— KPRONET .git/HEAD probe - JA4
t13i1909h2_9dc949149365_97f8aa674fd9+ JA37c1e207beb00684bbbe144f1b0abe1d5— FLOKINET SPARK beacon TLS - JA4H
po11nn0600_c9506d37ac14— SPARK POST /api/client/update - JA4H
po11nn0700_e1eadaf42879— WinRM /wsman (KAOPU + PLI shared)
Detection Patterns:
- PROTON66 MSSQL: TDS pre-login packets from 176.120.22.0/24 to non-standard 1xxx-6xxxx ports
- SPARK C2:
POST /api/client/updatewithSPARK COMMIT:user agent and secret header from 185.100.87.136 - PFCLOUD proxy gate: HTTP 407 on port 9191 from 204.76.203.0/24, error body “your plan expired”
- PFCLOUD clone signal: identical ClickHouse banner on 9009 across 204.76.203.224 and .226
- KPRONET exfil:
/.envand/.git/HEADover TLS 443 with rotating user agents from 77.83.39.6/.94 - AEZA P2P: qBittorrent protocol handshake with
qB5230suffix on port 16663 from 77.110.106.52
Full data: https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-08-17/