Executive Summary
This run resets the baseline. We reconfigured the Sponge sensor fleet on 2026-08-28, and the new sensor set sees far more traffic than the old one. Week-over-week percentages against the 2026-08-23 run are artifacts of that change, not real growth. Treat this report as the new reference point.
Volume concentrates in a familiar set. KAOPU-HK (AS138915) top talkers produced 1.38 million sessions, and PFCLOUD (AS51396) produced 873,000. The PFCLOUD share is up sharply as well as its raw count. Its sources now aim most of their traffic at SSH and web ports on our sensors. PROTON66 (AS198953) and AEZA-AS (AS210644) follow at 124,000 and 83,000 sessions.
Two long-running actors carried over from prior weeks. The PFCLOUD proxy validator 204.76.203.7 still sends GET http://azenv.net/ around the clock. The PROTON66 MSSQL sweeper 176.120.22.61 ran a fourth week. The FLOKINET beacon host 185.100.87.136 stayed live and rotated its endpoints again. Its TLS client fingerprint now also appears on an AEZA host, which puts one beacon tool on two bulletproof networks.
Our three-node honeypot fleet gave this report its first ground-truth campaign data. The fleet absorbed five distinct campaigns within 36 hours of its first request: a PHPUnit RCE swarm, a Docker registry hunt, a credential-file sweep, a cloud metadata hunt, and a WordPress batch abuse run with forged X-Forwarded-For: 127.0.0.1 headers. One residential Dutch IP ran a full four-stage intrusion chain against two nodes. Three of these campaigns trace to the same bulletproof ASNs this report tracks.
By the Numbers
Sessions below sum the top 20 source IPs per ASN. The Sponge API caps per-ASN totals in its response, so top-talker sums are the comparable measure across runs. Honeylabs counts are sampled events from daily windows.
| ASN | Provider | Top-Talker Sessions | Honeylabs Events | Censys Hosts | Top Port | Change |
|---|---|---|---|---|---|---|
| AS138915 | KAOPU-HK | 1,380,255 | 1 | 13,554 | 123 (NTP) | baseline |
| AS51396 | PFCLOUD | 873,217 | 156 | 1,917 | 22 (SSH) | baseline |
| AS198953 | PROTON66 | 124,209 | 134 | 360 | 22 (SSH) | baseline |
| AS51852 | PLI-AS | 89,208 | 102 | 8,641 | 23 (Telnet) | baseline |
| AS210644 | AEZA-AS | 83,104 | 44 | 72,191 | 22 (SSH) | baseline |
| AS216246 | RU-AEZA-AS | 66,776 | 0 | 7,024 | 8888 | baseline |
| AS14956 | ROUTERHOSTING | 8,649 | 36 | 25,654 | 22 (SSH) | baseline |
| AS214940 | KPRONET | 8,609 | 0 | 0 | 443 (HTTPS) | baseline |
| AS400992 | ZHOUYISAT | 2,970 | 1 | 7,781 | 80 (HTTP) | baseline |
| AS200593 | PROSPERO-AS | 2,959 | 0 | 348 | 443 (HTTPS) | baseline |
| AS200651 | FLOKINET | 3,255 | 12 | 3,806 | 443 (HTTPS) | baseline |
| AS209847 | THE | 2,850 | 0 | 1,784 | 22 (SSH) | baseline |
| AS213702 | QWINS-LTD | 2,341 | 0 | 7,381 | 443 (HTTPS) | baseline |
| AS57043 | HOSTKEY-AS | 1,990 | 0 | 101,011 | 23 (Telnet) | baseline |
| AS30823 | AUROLOGIC | 935 | 0 | 2,036 | 80 (HTTP) | baseline |
| AS211720 | Datashield | 299 | 0 | 50 | 5405 | baseline |
| AS33993 | UFO-AS | 48 | 0 | 4,842 | 22 (SSH) | baseline |
| AS214351 | FEMOIT | 18 | 6 | 712 | 1723 (PPTP) | baseline |
| AS140666 | ADPL-AS-AP | 7 | 0 | 2,805 | n/a | baseline |
| AS58854 | KAOPY | 5 | 0 | 624 | 3389 (RDP) | baseline |
| Silent (4 ASNs) | Various | 0 | 0 | — | — | — |
“Silent” covers AS206728, AS216309, AS202685, and AS394711. Every monitored ASN with a Censys footprint carries the BULLETPROOF label.
Top ASN Deep Dives
AS138915 (KAOPU-HK / Kaopu Cloud)
The 38.54.2.0/24 cluster again produced most of the volume. The port-sprawl behavior we documented last week persists at scale. Destination ports 123, 80, 443, 1900, and 5355 lead the session counts. That mix of NTP, SSDP, and LLMNR traffic is the classic profile of an amplification reflector farm.
Censys profiled 13,554 hosts in the ASN. The certificate stack still leans on GlobalSign OV issuers, and prod-vpn.example.com still appears on 2,346 hosts. OpenSSH, openresty, and tengine dominate the software list. One address in this range answered on about 100 different ports in prior weeks. Discount this range during recon triage, because almost every port returns a plausible service banner.
AS51396 (PFCLOUD / Pfcloud UG)
PFCLOUD sources aimed 489,000 sessions at SSH and 227,000 at HTTP. The 204.76.203.0/24 proxy fleet keeps its shape. Its top validator 204.76.203.7 sent 1,095 honeypot events this week, almost all of them GET http://azenv.net/ proxy checks from a Go client. Hosts 45.135.193.193 and 45.135.194.113 continue the same open-proxy validation work. Censys shows the YE1 and YE2 certificate series on 110 and 105 hosts.
The ASN is also the source of the single most persistent actor our honeypot fleet saw this month. Host 204.76.203.18 ran a low-and-slow recon campaign against a honeypot node for more than three days without a break. It swept 566 distinct paths across 2,173 events in one 28-hour window. Feed lists flag the address on both ipsum and firehol2. Honeylabs history shows 14 swept ports on the same address earlier in the year. A validator by day, a stalker by night, and a top-talker in Arkime: this one host links all three of our data sources.
AS198953 (PROTON66)
Host 176.120.22.61 ran its MSSQL-TDS sweep for a fourth week, this time with 1,141 honeypot events. Its pre-login packets remain byte-identical across target ports. Host 176.120.22.43 added a new trick: 42 requests against VPN appliance logins, including /global-protect/login.esp (Palo Alto GlobalProtect) and /+CSCOE+/logon.html (Cisco ASA clientless VPN). The pair shares an RDP-facing profile in Censys.
PROTON66 sits on only 360 Censys-visible hosts, but it out-produces ASNs with 40 times the footprint. The AnyDesk Client certificate issuer from last week is still present on 11 hosts. The Plesk and YR-series issuers round out a small but dense operator platform.
AS210644 (AEZA-AS)
AEZA’s top three hosts (81.19.137.20, 138.124.91.58, 213.165.46.78) sent about 26,000 sessions each. Destination ports 22, 8022, 2222, and 22222 lead the counts, so the ASN farms SSH on both standard and alternate ports. The Censys footprint holds 72,191 hosts, the second largest in the set.
The beacon finding sits here. AEZA host 147.45.71.214 presents the same JA4 fingerprint t13i1909h2_9dc949149365_97f8aa674fd9 that the FLOKINET beacon host used. It hit ports in the 8080 to 8989 range, requested /v1/getinfo, and rotated forged browser user agents across requests. An agent that reports getinfo to high ephemeral ports and borrows a known beacon TLS stack is a strong correlation signal across the two ASNs.
The YE certificate series also grew. YE1 now covers 13,008 hosts and YE2 covers 13,117 in AEZA alone, so the Xray panel supply chain remains the ASN’s backbone.
AS51852 (PLI-AS / Private Layer)
PLI-AS top talkers sent 35,000 sessions to Telnet and 27,000 to SSH. The 179.43.0.0/16 block carried most of the load, with 190.211.255.210 alone at 34,911. Port 5432 (PostgreSQL), 135 (RPC), and 27017 (MongoDB) also appear in the destination profile. This is a brute-force shop with a database focus.
The Censys profile lists Hydra Authentication RSA SubCA #155 on 903 hosts. Hydra is an apt name for a network whose certificate tree grows heads on both Telnet and database ports. Dovecot and Exim in the software list add a mail relay tier to the usual nginx and OpenSSH stack.
Infrastructure Correlation
One TLS client fingerprint now spans two ASNs. t13i1909h2_9dc949149365_97f8aa674fd9 appeared last week only on the FLOKINET beacon host 185.100.87.136. This week it also covers requests from AEZA host 147.45.71.214. The FLOKINET host itself rotated endpoints again: it now checks in at /api/checkin, polls /eventmanager, and pulls updates at /api/client/update?arch=amd64&commit=08059e95dacaf. Track this family by fingerprint, not by path.
The PFCLOUD attack fleet shows tight clustering. Six of the ten loudest honeypot attackers this week sit in PFCLOUD, five of them in the 204.76.203.0/24 and 45.135.192.0/19 ranges. Censys lists SSH on port 22 for every one of the six. The PROTON66 pair shares RDP on 3389. No shared SSH host keys or HASSH values surfaced this week, but the port discipline alone marks these as maintained platforms.
The honeypot fleet tied the aggregate view to live campaigns. A registry-hunt tool ran a byte-identical 12-step journey against two honeypot nodes for three straight days. Each day it arrived from a fresh set of DigitalOcean hosts, 14 or more in total. Its steps include WebLogic console probes, Confluence and cPanel logins, and Docker Registry API calls against internal service names such as /v2/internal/api-gateway/tags/list. The journey shape, not the IP set, is the real indicator.
A second family industrialized this pattern. Six Google Cloud hosts in six regions ran template sweeps of 65 to 130 service families with POST bodies. One of them, 34.63.40.186, fired 8,146 POSTs at /xmlrpc.php in 31 minutes. Cloud-hosted scan platforms of this size behave like commercial services, and GCP hosts the largest one we see.
Fleet Observations
Censys attaches the BULLETPROOF label to every monitored ASN with a routable footprint. The label counts are stable: HOSTKEY-AS holds the largest at 101,011 hosts, AEZA-AS follows at 72,191, and ROUTERHOSTING at 25,654.
KPRONET (AS214940) is the outlier. Its sources sent 8,609 sessions, yet Censys lists zero visible hosts in the ASN. Every KPRONET host that scans is invisible to internet-wide scanning. The block also added SMTP ports 25, 465, and 587 to its destination profile, which suggests a mail tier behind the scan front.
The honeypot fleet’s fresh Middle East node grew from 2,052 to 24,100 events over three days. A fresh cloud IP enters the heavy-scan population in hours, not weeks. The two EU nodes drew disproportionate interest from the GCP sweep family and the registry-hunt tool, which suggests both target cloud-flavored fleets first.
Hosts to watch:
204.76.203.18(PFCLOUD) — three-day continuous recon campaign, 566 paths. Block.204.76.203.7,45.135.193.193,45.135.194.113(PFCLOUD) — proxy validation fleet. Alert onazenv.nettargets.176.120.22.61(PROTON66) — MSSQL sweeper, fourth active week.176.120.22.43(PROTON66) — GlobalProtect and Cisco ASA login prober.147.45.71.214(AEZA-AS) — beacon-family host with FLOKINET fingerprint. Alert on JA4 below.185.100.87.136(FLOKINET) — beacon host, endpoints rotated again.45.148.10.183and45.148.10.238(Techoff Srv, NL/BG) — industrial template sweeps, 8,300 events in 20 minutes.213.209.159.175(Feo Prest SRL, DE) — credential-file sweeps,.envand SSH key hunting, listed on ipsum and firehol2.81.172.241.94(DELTA Fiber, NL, residential) — four-stage intrusion chain. Watch for return.34.63.40.186(Google Cloud, US) — xmlrpc brute, 8,146 POSTs in 31 minutes.169.150.201.29(Datacamp, DE) — 12,707-path malware dropper dictionary in 60 seconds.93.152.223.194(RMP Protection, BG) — CI config and SSH key crawler, 71 families.
Fingerprints and payload markers:
- JA4
t13i1909h2_9dc949149365_97f8aa674fd9— beacon family, now on two ASNs. - JA4
t13i1010h1_61a7ad8aa9b6_3a8073edd8ef— PROTON66 VPN login prober. - JA4
t12i130500_2d7513195f68_e51b7354d87f— AEZA high-port agent traffic. - POST body
<?php echo "NightAgent";?>inside PHPUniteval-stdin.phprequests — webshell implantation test. UNION SELECT ... CONCAT(0x7c7c, HEX(...), 0x7c7c)insidewp-json/batch/v1multiplex bodies — blind SQLi exfil attempt.X-Forwarded-For: 127.0.0.1plusX-Real-Ip: 127.0.0.1on external requests — log-evasion tradecraft.
Paths to watch:
/v2/internal/api-gateway/tags/list,/v2/internal/auth-service/manifests/latest— internal registry enumeration./vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php— PHPUnit RCE, now fleet-wide for three days./xmlrpc.php— WordPress credential amplification./api/checkin,/eventmanager,/api/client/update— beacon endpoints, check by JA4./global-protect/login.esp,/+CSCOE+/logon.html— VPN appliance brute targets./.env,/.aws/credentials,/tfstate,/firebase.json— credential harvest sweeps.
Full data for this run, including raw event samples, per-ASN aggregations, and the change log: kevlar/2026-08-31