Bulletproof Hosting Watch: Week of 2026-10-19

Executive Summary

Honeylabs event volume across the 25 watched ASNs rose to 27,729 from 15,118, a gain of 83.4 percent. Nine providers produced events this week against six last week. KAOPY (AS58854) returned events for the first time in the watch set, and HOSTKEY-AS (AS57043) returned after a quiet week. PFCLOUD (AS51396) alone accounts for 23,978 events, or 86.5 percent of the total.

Sponge recorded 3,647,152 sessions in the top-20 source-IP buckets per ASN, against 3,387,874 last week. That figure counts every stored session for a provider’s busiest sources, not the week alone, so the 7.7 percent rise reflects accumulated history. The same aggregation inside the week window returns 348,149 sessions, and the hourly timeline for the 25 ASNs returns 359,249. Both weekly figures count only observed sessions, and the top-20 method undercounts busy providers.

Censys matched 266,732 hosts, up 0.5 percent from 265,275. The fleet profile held steady. Port 22 carries 35.5 percent of services, HTTP carries 50.1 percent of protocol buckets, and Linux runs on 93.4 percent of hosts with a known operating system.

Three findings carry the week. PFCLOUD operated five hosts with an identical SSH host key and an identical service set. PROSPERO-AS (AS200593) doubled its Sponge footprint, and one source sent 14,180 sessions across random high ports at two destination addresses. PLI-AS (AS51852) tripled its event count.

By the Numbers

Sponge session counts sum the top-20 source-IP buckets per ASN, the same method in both weeks. Event counts come from Honeylabs asn_enrich.total_events over the window 2026-10-12 to 2026-10-19. The top port comes from the Censys per-ASN port aggregate, which counts every service on matching hosts. The change column follows event volume when a provider reported events in either week, and Sponge sessions otherwise. A plain number marks a provider with no events in the baseline week.

Per-Provider Detail

AS51396 (PFCLOUD, Pfcloud UG)

Pfcloud carried 23,978 events, up from 12,260, and remains the largest event source in the watch set. Forty-five source IPs produced those events, in the Netherlands, Germany, the UAE, and Ukraine. The 204.76.203.0/24 subnet supplies the busiest sources, led by 204.76.203.231 at 4,877 events, then 204.76.203.43, .40, .44, and .53 at roughly 2,400 each.

The traffic shape is proxy abuse. Application labels read socks5 at 82 sampled events, http_connect at 68, ssh at 60, and http at 46. Captured CONNECT paths name icanhazip.com:443 48 times, httpbin.org:443 20 times, and http://proxy.flarevpn.digital:8080/judge 10 times. That last path sends a client through a proxy to a judge endpoint, which is how proxy-check tooling scores an exit node. Honeylabs target ports lead with 25565 Minecraft, then 80, 8080, 81, 8081, and 443.

Sponge shows a separate burst. Five addresses, 204.76.203.4, .212, .214, .221, and .222, each sent roughly 32,000 sessions inside the week. Three destination addresses absorbed almost all of it: 217.15.163.226, 109.123.246.142, and 89.116.25.211. Destination ports spread across hundreds of values with two to three sessions each. That pattern fits a random-port flood rather than a scan with a fixed target list. 204.76.203.4 spread its sessions across five destinations in near-equal measure.

Censys sees 2,329 Pfcloud hosts and 3,236 services, led by port 22 at 900, then 80 at 390 and 443 at 300. Five enriched hosts share the SSH host key 5d74b972b1a82484596aca537381c8c66901d3aae0ef5140d9a297b7557ebed5. The same hosts expose an identical ten-port set (22, 80, 81, 443, 7070, 7781, 8123, 9000, 9004, 9009) and the same HASSH.

AS51852 (PLI-AS, Private Layer INC)

PLI-AS logged 1,609 events from eight source IPs, against 534 last week. Every source resolves to Switzerland. The top source, 179.43.167.3, produced 1,226 events and 7,771 Sponge sessions. Honeylabs records that address as a scanner with 1,331 events over 30 days and contact since 2026-09-19.

The target list shifts with the sample. asn_enrich leads with 8085, then 3125, 16000, 4153, 10000, and 1111. The event sample shows SIP requests to high ports and PPTP 1723. The mix pairs VoIP probing with VPN and proxy endpoints, which matches the provider’s role as a low-cost network host.

Sponge shows SSH and telnet across the provider’s history. The week window returns 12,603 sessions from the top-20 sources, led by 179.43.167.3 at 7,771 and 190.211.252.4 at 3,604. Destination ports in that window lead with 22 at 779, then a spread of high ports: 5060, 5160, 5080, 4771, and 5050.

Censys records 9,502 hosts and 29,358 services. Port 443 leads at 4,950, then 22 at 4,327, SNMP 161 at 3,667, 80 at 3,531, and 123 at 1,893. The service profile barely moved from last week, which places the change in activity rather than in exposed infrastructure.

AS198953 (PROTON66)

Proton66 returned 1,333 events, down 33.0 percent from 1,989. Four source IPs account for all of them, and all four sit in Russia. The top source, 176.120.22.61, produced 1,030 events. A second host, 37.77.150.100, produced 280.

The target list is remote desktop and alternate web ports: 3389 first, then 10443, 1488, 21433, 1466, and a tail of high ports. Two JA4 values cover the sample, and no SSH client fingerprint appears, which points to a small tool set rather than a broad scanner fleet.

Sponge holds 129,868 sessions for the provider, flat against last week. The week window adds 42 sessions, led by 176.120.22.61 at 23 and 176.120.22.240 at 19. Port 22 carries 18 of those sessions.

Censys sees 21 Proton66 hosts and 28 services, led by 3389 at seven, 443 at five, and 80 at four. That is a small exposed surface for a provider with 129,868 Sponge sessions, and it does not explain the probe targets in the event sample.

AS58854 (KAOPY, Kaopu Cloud)

Kaopu Cloud returned 423 events after an empty prior week. One address, 27.0.135.12, sent every event to TCP/22 between 2026-10-18T16:45Z and 17:08Z. Honeylabs rates the address as probing, with 423 events over 30 days and one targeted port. The SSH client HASSH is 98ddc5604ef6a1006a2b49a58759fbe6.

The burst is short and concentrated. Twenty-two minutes of SSH contact with no other port and no HTTP path is a narrow signature. It fits a credential attempt against a single host, not a sweep.

Sponge returned no sessions in the week window for this provider, so Arkime did not observe the source. Censys sees 484 Kaopu hosts and 2,233 services, led by port 8887 at 183 services, then 22, 443, and a run of high ports. The SSH target in the event sample sits outside that exposed set.

AS200593 (PROSPERO-AS)

PROSPERO-AS doubled its Sponge footprint. The all-time top-20 sum rose to 32,788 from 16,480, and 18,616 of those sessions fall inside the week window. One address, 91.202.233.49, accounts for 14,180 sessions. Two destinations in 130.94.89.0/24 absorbed almost all of them, and destination ports spread across hundreds of high values with two to three sessions each. A second address, 193.24.123.120, sent 3,703 sessions with the same shape. Random high ports at fixed destinations fit a packet flood rather than a scan with a target list.

Honeylabs shows a separate RDP campaign. It recorded 189 events from three addresses, down 13.3 percent. The top source, 91.202.233.27, produced 181 events on RDP and a cluster of alternate terminal ports: 14000, 33333, 13389, 13000, and 33380. The event sample also carries the FiveM-Public-Metadata/1.0 user agent and /info.json requests, the same game-server signature this provider showed last week. The sources sit in Turkmenistan and Russia.

Censys sees 15 hosts and 20 services, led by 22 at five, 80 at four, and 443 at three. The host count held at 15, so the volume growth came from existing hosts.

Infrastructure Correlation

The strongest signal this week is a cloned configuration inside PFCLOUD. Five hosts in 204.76.203.0/24 share one SSH host key, one HASSH (e42184b06d45385a906f0803d04c83da), and one ten-port service set. A shared host key across five addresses means one image or one deployment script, not five independent servers. The same block also carries two proxy subtypes in the event sample, socks5 and HTTP CONNECT.

Cross-provider tool reuse continues. The HASSH e54ef3ec27fe1fea7ab64d3fa05359fd appeared last week on 185.100.87.136 in FLOKINET and returns this week on 178.208.88.6 in IRONHOST. The JA4 t13i251000_b78ed14e2fd0_ab7e3b40a677 appeared last week on 172.86.118.127 in ROUTERHOSTING and returns on 91.215.85.104 in PROSPERO-AS. One client fingerprint across two providers points to one operator renting from both.

IRONHOST shows a different change. Censys host count rose to 7,591 from 5,465, and services to 14,442 from 9,470. Ports 22, 443, and 80 each gained about 50 percent, and port 21 FTP rose to 525 from 272. Sponge sessions stayed at 152 and Honeylabs returned one event, so the growth sits in newly exposed hosts rather than in new attack traffic.

Fleet Observations

The Censys fleet grew to 266,732 hosts from 265,275. The top-20 service buckets sum to 550,405 against 545,064.

Port shares held within a third of a point. Port 22 leads at 35.5 percent against 35.2, port 443 sits at 22.9 against 22.6, and port 80 sits at 15.5 against 15.3. Port 2096, a Censys scan port, holds 5.3 percent against 5.4. Port 8443 holds 3.9 against 3.8.

The protocol mix stayed flat. HTTP holds 50.1 percent against 50.0, SSH 25.3 against 25.1, and UNKNOWN 7.3 against 7.1. VNC fell to 5.9 from 6.1 and RDP fell to 1.6 from 1.7. The VNC decline runs against the HOSTKEY VNC sweep in the event data. Provider-level signals can sit inside a flat fleet average.

Software shares moved by less than half a point each. OpenSSH holds 37.7 percent against 37.5, nginx 27.7 against 27.4, and Caddy 2.6 against 2.5. Linux covers 93.4 percent of hosts with an operating system, up from 92.9. Windows holds at 3.7.

Certificate issuers still concentrate on the YE1 and YE2 intermediates, at 20.7 and 21.1 percent. Both gained about half a point, which tracks host growth rather than a shift in issuer choice. The invalid2.invalid placeholder holds 11.5 percent.

IoCs and Detection Guidance

102 addresses appeared this week and 25 dropped off. The list draws on Sponge top sources, Honeylabs enrichment, and the 622-record event sample. ROUTERHOSTING added the most at 22, then KPRONET at 17, PLI-AS at 14, PFCLOUD at 13, and KAOPU-HK at 10.

Proxy-check traffic deserves a filter. PFCLOUD sent 48 requests to icanhazip.com:443, 20 to httpbin.org:443, and 10 to http://proxy.flarevpn.digital:8080/judge over HTTP CONNECT. A host that opens CONNECT to a judge endpoint is testing whether a proxy exit works, and that pattern rarely appears in ordinary scanning.

Scanner user agents worth blocking: opendir-portscan/0.1, 0day, FiveM-Public-Metadata/1.0, Go-http-client/1.1, and curl/8.0.

HOSTKEY-AS returned to the event set with a VNC sweep. 91.108.247.4 sent 108 events to VNC-range ports, including 5938, 6003, and 6008, and the provider’s week Sponge traffic leads with TCP/30333.

TLS and SSH fingerprints from the sample:

• JA4 t12i280600_d943125447b4_e7e480e5a997 on 176.120.22.61 (PROTON66).
• JA4 t13i1311h2_f57a46bbacb6_ab7e3b40a677 on 176.120.22.240 (PROTON66).
• JA4 t13i190800_9dc949149365_97f8aa674fd9 on 45.135.193.198 (PFCLOUD).
• HASSH 98ddc5604ef6a1006a2b49a58759fbe6 on 27.0.135.12 (KAOPY).
• HASSH e54ef3ec27fe1fea7ab64d3fa05359fd on 178.208.88.6 (IRONHOST).
• SSH host key 5d74b972b1a82484596aca537381c8c66901d3aae0ef5140d9a297b7557ebed5 on five PFCLOUD hosts.

Hosts to watch: 91.202.233.49 for flood volume, 179.43.167.3 for SIP and PPTP probing, 27.0.135.12 for the SSH burst, and the five 204.76.203.x hosts that share one key.

The full IP list, fingerprint list, and request-path list sit in the run data: https://rud.is/git/gists/tree/kevlar/2026-10-19/