Executive Summary
Activity fell across the two largest providers this week. PFCLOUD (AS51396) lost 15% of its Sponge session volume and KAOPU-HK (AS138915) held steady. Both still dominate the monitored set by a wide margin. Seventeen of the 25 monitored ASNs sent traffic to our sensors. Eight stayed silent.
Three ASNs stand out this week. PLI-AS (AS51852) grew 341% to 5,302 Sponge sessions. AUROLOGIC (AS30823) grew from 5 sessions to 274. Its growth came from a single new scanner. FLOKINET (AS200651) grew 351%, driven by the Tor exit node we flagged last week.
The AUROLOGIC scanner is the most interesting find of the week. The host 45.11.18.33 sent 455 RDP probes with the cookie mstshash=hello. Censys shows that this host runs a Windows Server 2016 domain controller for the domain ad.reiscrew.de. It exposes LDAP, SMB 3.0.2, RDP, and WinRM to the internet. A German company ERP server on a bulletproof network now runs masscan-style RDP sweeps. This is a compromised corporate machine.
The FLOKINET beacon host 185.100.87.136 changed its callback endpoint. Last week it sent POST /api/client/update with a “SPARK COMMIT” user agent. This week it sends POST /api/checkin on port 8443 and requests /images/transparentpix.gif over TLS 1.3. The same TLS fingerprint t13i1909h2_9dc949149365_97f8aa674fd9 appears in both weeks. The operator rotated the endpoint but kept the infrastructure.
By the Numbers
| ASN | Provider | Sponge Sessions | Honeylabs Events | Top Port | Change vs Prior Week |
|---|---|---|---|---|---|
| AS51396 | PFCLOUD | 63,088 | ~13,000 | 22 (SSH) | -15% |
| AS138915 | KAOPU-HK | 62,464 | 2 | 123 (NTP) | -1% |
| AS51852 | PLI-AS | 5,302 | ~121 | 22 (SSH) | +341% |
| AS198953 | PROTON66 | 677 | ~645 | 22 (SSH) | -42% |
| AS30823 | AUROLOGIC | 274 | ~455 | 3389 (RDP) | +5380% |
| AS214940 | KPRONET | 219 | 0 | 80 (HTTP) | +146% |
| AS400992 | ZHOUYISAT | 217 | 0 | 443 (HTTPS) | +43% |
| AS200651 | FLOKINET | 167 | ~11 | 6882 | +351% |
| AS14956 | ROUTERHOSTING | 164 | ~130 | 443 (HTTPS) | -48% |
| AS211720 | Datashield | 23 | 0 | 443 (HTTPS) | new |
| AS200593 | PROSPERO-AS | 20 | ~6 | 443 (HTTPS) | +900% |
| AS209847 | THE | 12 | 0 | 3389 (RDP) | -80% |
| AS214351 | FEMOIT | 9 | ~2 | 1723 (PPTP) | new |
| AS210644 | AEZA-AS | 7 | 0 | 8890 | -91% |
| AS57043 | HOSTKEY-AS | 2 | ~2 | 443 (HTTPS) | -93% |
| AS33993 | UFO-AS | 1 | 0 | 51820 | new |
| AS216246 | RU-AEZA-AS | 1 | 0 | 443 (HTTPS) | new |
| Others (8 ASNs) | Various | 0 | 0 | — | — |
“Others” covers AS216139, AS213702, AS206728, AS216309, AS140666, AS58854, AS202685, AS394711 with no observed sessions in either week.
Top ASN Deep Dives
AS51396 (PFCLOUD / Pfcloud UG)
PFCLOUD remains the most active provider. Its honeypot event count held near 13,000. The proxy fleet in 204.76.203.0/24 keeps its shape. Nodes .224, .225, and .226 each generated about 1,800 events. All three went quiet on 2026-08-20. Fleet node .225 still runs the same stack as the clone pair we reported last week: ClickHouse on 9000 and 8123, a proxy on 9191, and a Minecraft server on 25565.
The clearest new signal is the proxy-validation pipeline. Host 204.76.203.7 tests open proxies around the clock. It sends GET http://azenv.net/ and CONNECT httpbin.org:443 with a Go-http-client/1.1 user agent. It also sends SOCKS5 handshake bytes \u0005\u0001\u0000. A second node, 45.135.194.113, checks proxy.flarevpn.digital:8080/judge. A third, 45.135.193.193, sweeps every common proxy port with HTTP CONNECT probes. GreyNoise classifies 204.76.203.7 as malicious. Its tags include Ivanti Connect Secure, Pulse Secure, F5 BIG-IP, CrushFTP, and Sophos scanners. The node validates proxies by day and hunts VPN appliance CVEs in between.
WHOIS adds a useful detail. The 204.76.203.0/24 block belongs to “Intelligence Hosting LLC” in Eygelshoven, NL. PFCLOUD is the trade name. The Censys YE-series certificate family grew again. YE1 rose from 101 to 116 hosts and YE2 from 93 to 95. The overall Censys footprint shrank from 1,910 to 1,856 hosts.
AS138915 (KAOPU-HK / Kaopu Cloud)
KAOPU-HK held steady at about 62,000 sessions. The 38.54.2.0/24 cluster produced almost all of them. Host 38.54.2.209 alone sent 43,196 sessions this week. Censys explains the volume. This one address answers HTTP on about 100 different ports. The ports include 23, 53, 74, 943, 1963, 2112, 5901, 6443, 9200, 27017, and 44818. Almost every port a scanner tries returns an HTTP response. This is a port-sprawl farm. It inflates scanner results and hides real services.
The ASN-level Censys profile shows the same pattern at scale. Ports 32080, 43080, 40003, and the 408xx range each hold about 2,300 hosts. The software stack runs openresty and tengine in front of squid and OpenVPN. The certificate profile leans on GlobalSign OV issuers, plus prod-vpn.example.com on 2,367 hosts. This looks like a bulk commercial proxy network more than a classic bulletproof host shop.
AS198953 (PROTON66)
PROTON66 dropped 42% to 677 sessions. The MSSQL-TDS sweeper 176.120.22.61 returned for a third week. It sent 598 events between 2026-08-20 and 2026-08-21. The pre-login packets remain byte-identical across every target port. Censys shows the host unchanged. It still exposes DCERPC with SCMR and SAMR bindings, NetBIOS, RDP with a self-signed SHA1 certificate, and WinRM. The RDP certificate common name is still M051108. The box performs the same brute force it receives.
A second host, 176.120.22.240, sent 47 events against high ephemeral ports. The ASN’s certificate profile added an “AnyDesk Client” issuer on 11 hosts. Remote-access tool certificates on a bulletproof network suggest operator access paths, not customer services.
AS30823 (AUROLOGIC)
AUROLOGIC produced this week’s sharpest change. Session volume grew from 5 to 274, and honeypot events reached 455. One host caused all of it. The host 45.11.18.33 sent RDP connection requests to port 3389 every one to three minutes for ten hours on 2026-08-20. Each request carried the cookie mstshash=hello. This cookie pattern matches masscan and similar RDP sweep tools.
Censys identifies the host as erp01.ad.reiscrew.de. It runs Windows Server 2016 and the Active Directory domain ad.reiscrew.de. LDAP on port 389 leaks the domain structure. SMB 3.0.2 answers with NTLM. RDP accepts RDSTLS with restricted admin mode. WinRM on 5985 is open. The network block 45.11.18.0/24 is registered to aurologic GmbH with the name “Network used for hosting/infrastructure”. A German firm’s ERP and directory server sits on that block and now runs RDP sweeps. Treat the domain reiscrew.de and the host certificate erp01.ad.reiscrew.de as compromise indicators.
AS51852 (PLI-AS / Private Layer)
PLI-AS grew 341% to 5,302 sessions. Three hosts drive the activity. Host 81.17.28.131 scanned ports 8089, 8899, and 135. It probed DCE/RPC endpoints. Host 46.19.138.42 runs a market-maker bot. It requests /version, /pairs, and /v6/marketmaker/status/1 with the user agents mmsk-scout/1.0 and mm-scout/1.0. These paths match Hummingbot-style crypto market-maker APIs. The operator hunts exposed trading bots. Host 179.43.150.26 probed a Vite dev server on port 5173. It requested /.env and generated random paths like /z875 and /.e9951 in the same session.
The fleet linkage from prior weeks persists. Host 81.17.28.131 presents SSH HASSH 41ff3ecd1458b0bf86e1b4891636213e. This is the same server SSH fingerprint as the PFCLOUD clone pair 204.76.203.221 and .214. The same SSH stack spans both ASNs for a third straight week.
Infrastructure Correlation
The cross-ASN Xray panel fleet persists. The YE1/YE2/YR1/YR2 certificate series appears on six of the monitored ASNs. AEZA-AS (AS210644) carries the largest share. Its Censys footprint holds 72,914 hosts, and YE-series certificates cover more than 26,000 of them. RouterHosting (AS14956) follows with about 5,800. PFCLOUD, PLI-AS, FLOKINET, and AUROLOGIC carry smaller counts. The shared certificate family ties these providers to one panel software supply chain.
RouterHosting and AUROLOGIC share a second signal: cloned Windows images. RouterHosting shows self-signed certificate series windows-Dallas0, windows-Utah-4g, windows-Utah-4H, and windows-Amsterd across more than 2,200 hosts. AUROLOGIC shows windows-DE-Fran and windows-Frankfu on 117 hosts. One AUROLOGIC host even presents a certificate for 172.86.93, a RouterHosting subnet. The two providers share a Windows image source.
The FLOKINET beacon host 185.100.87.136 rotated its callback path. Detection rules that watch only /api/client/update are now stale. Alert on the host plus its TLS fingerprint t13i1909h2_9dc949149365_97f8aa674fd9 instead. The JA4H po11nn0500_e4a47a99f1ac covers the checkin requests.
Fleet Observations
KPRONET (AS214940) resumed its .git and .env crawl. Volume grew 146% to 219 sessions. The sources 77.83.39.94, .15, and .6 sent most of it. Port 80 carried 106 of the sessions. Censys reports no routable hosts for this ASN. The 77.83.39.0/24 block still maps to PFCLOUD in Censys. Honeylabs maps it to KPRONET. One source remains stale.
RouterHosting’s PHPUnit campaign continued from a new host. The host 107.189.26.103 reversed to 103.26.189.107.static.cloudzy.com. It sent 99 requests with the user agent libredtail-http to eval-stdin.php under 15 path prefixes. The same host probed the Docker API at /containers/json and tried ThinkPHP RCE payloads. It runs Apache 2.4.29, a 2018 build with known critical CVEs, plus an L2TP endpoint with hostname sasradius. Cloudzy customers get attack infrastructure with their VPS.
HOSTKEY-AS (AS57043) and AEZA-AS (AS210644) both collapsed this week, -93% and -91%. AEZA’s Censys footprint remains the second largest in the set at 72,914 hosts. The scanning silence is a pause, not a shutdown.
IoCs and Detection Guidance
Hosts to watch:
45.11.18.33(AUROLOGIC) — compromised AD domain controllererp01.ad.reiscrew.de. Block and report. Alert on any outbound RDP probes withmstshash=hello.185.100.87.136(FLOKINET) — Tor exit beacon host. Alert on JA4t13i1909h2_9dc949149365_97f8aa674fd9and JA4Hpo11nn0500_e4a47a99f1ac.176.120.22.61(PROTON66) — MSSQL sweeper, third active week. Alert on TDS pre-login packets to non-standard ports.204.76.203.7,45.135.194.113,45.135.193.193(PFCLOUD) — proxy validation fleet. Alert onazenv.netandproxy.flarevpn.digitalrequest targets.107.189.26.103(RouterHosting/Cloudzy) —libredtail-httpuser agent, PHPUnit eval-stdin sweep.38.54.2.209and the 38.54.2.0/24 cluster (KAOPU-HK) — port-sprawl farm. Discount HTTP responses from this range during recon triage.
Fingerprints:
- JA4
t13i1909h2_9dc949149365_97f8aa674fd9— FLOKINET beacon TLS client. - JA4
t13i251000_b78ed14e2fd0_ab7e3b40a677—.git/HEADcrawler on PFCLOUD and RouterHosting hosts. - JA4H
ge11nn0400_9c3956fad5da— Go-http-client proxy validation requests. - HASSH
41ff3ecd1458b0bf86e1b4891636213e— shared SSH server config across PFCLOUD and PLI-AS.
Paths to watch:
/api/checkin,/api/client/update— FLOKINET beacon endpoints./vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.phpunder any prefix — PHPUnit RCE sweep./version,/pairs,/v6/marketmaker/status/1— market-maker bot discovery./containers/json— Docker API discovery./.env,/.git/HEAD— credential and source exfiltration.
Full data for this run, including raw event samples, per-ASN aggregations, and the change log: kevlar/2026-08-23