Bulletproof Hosting Watch: Week of 2026-10-26

Executive Summary

Honeylabs recorded 32,387 events from the 25 watched ASNs, against 27,729 last week. Nine providers produced events this week, the same count as last week, though the sets differ. AEZA-AS (AS210644) accounts for most of the change. It reported nothing last week and 8,835 events this week, and one host, 109.120.179.192, sent 8,816 of them. PFCLOUD (AS51396) remains the largest source at 21,933 events, down 8.5 percent.

Sponge recorded 180,578 sessions inside the 7-day window, against 351,398 for the prior window. That is a 48.6 percent fall, and it concentrates in three providers. PFCLOUD dropped 62 percent, PROSPERO-AS (AS200593) dropped 63 percent, and PLI-AS (AS51852) dropped 40 percent. The decline tracks specific hosts that went quiet, not a fleet-wide shift. Six providers rose, and eight recorded no sessions in either window. Sensor coverage is not constant, so read the fleet figure as an upper bound on the real decline.

Censys matched 270,498 hosts, up 1.4 percent from 266,732. The infrastructure profile barely moved: port shares, protocol shares, and software shares each changed by less than one point. Two structural findings stand out. A cluster of four Pfcloud hosts still shares one SSH host key and one 12-service layout. Proxy-check traffic through HTTP CONNECT now names api.ipinfo.io and api.i.pn alongside the icanhazip.com pattern from prior weeks.

By the Numbers

Sponge sessions count exact session totals for the 7-day window, summed from hourly per-ASN timelines. Events come from asn_enrich.total_events over 2026-10-19 to 2026-10-26. Top port comes from the Censys per-ASN port aggregate, which counts every service on matching hosts. The change column follows event volume when a provider reported events in either week, and Sponge sessions otherwise.

Event sampling is partial this week. Per-IP sampling returned 236 events across 31 addresses, and day-chunked queries returned few additional records. Counts in the table come from the server-side aggregate and do not depend on those samples.

Per-Provider Detail

AS51396 (PFCLOUD, Pfcloud UG)

Pfcloud carried 21,933 events, down 8.5 percent from 23,978. Sixty source IPs produced them, in the Netherlands, Germany, the UAE, and Ukraine. The busiest sources are 204.76.203.4 at 6,126 events and 204.76.203.231 at 5,298. Target ports lead with 25565 Minecraft, then 8080, 80, 25567, 25566, and 25568. Ports 2375, 3128, and 8081 follow. The mix points to game-server and proxy discovery rather than a single product exploit.

Sponge shows the real change. The week window holds 94,150 sessions against 248,662 last week. The prior week ran six high-volume nodes: 204.76.203.212, .213, .214, .221, .222, and 176.65.148.227, each between 19,000 and 32,400 sessions. This week only 204.76.203.4 remains at that scale, with 28,889 sessions. A second tier of .37, .38, .40, .43, .44, and .51 sits between 4,000 and 4,100 each. Destination ports lead with 80 at 4,854, 25565 at 3,254, 23 at 3,119, and 443 at 736.

The event sample keeps showing proxy enumeration. Application labels read socks5 at 34 events, http_connect at 26, and ssh at 20. Sampled destination ports spread across 25565, 8081, 10801, 1080, and 7777. No user agent and no JA4 appeared in the sample, which fits bare protocol handling by a proxy toolkit.

Censys sees 2,323 Pfcloud hosts, led by port 22 at 926, then 80 at 409 and 443 at 311. Ports 2458 and 12458 carry 200 services each, the same pairing the prior run recorded.

AS210644 (AEZA-AS, Aeza Group LLC)

AEZA reported nothing last week and 8,835 events this week, from two addresses. 109.120.179.192 sent 8,816 events between 2026-10-22 and 2026-10-25. 138.124.108.76 sent 19. Target ports lead with 443, then 4433, 8555, 8559, 8560, 5800, 8333, 8444, 5000, and 4068. The set mixes web, alternate web, and reflector-style ports.

The event sample is thin but specific. Twenty-five records cover ports 4028 at 13 events and 4433 at 6, plus memcached on 11210, 11211, and 11212. Application labels read memcached on six records. No HTTP path and no TLS fingerprint appears, so the probes carry raw or unexplained payloads.

Sponge shows almost nothing. The provider held six sessions in the week window, down from 444, and 109.120.179.192 does not appear in Sponge at all. Censys finds 67,139 hosts, up 516, led by port 22 at 58,388, 443 at 33,166, and 80 at 18,171. The burst host itself exposes one service, SSH on 22. A host with a single visible service and 8,816 honeypot events in four days fits a rented scan node better than a hosting customer.

AS198953 (PROTON66)

Proton66 returned 1,348 events, up 1.1 percent from 1,333. Six source IPs account for them, all in Russia. 176.120.22.61 leads at 931 events, then 176.120.22.89 at 205 and 37.77.150.86 at 182.

The target list is remote desktop and database: 3392, 3391, 3390, 80, 443, 6000, 21433, 1438, 18433, and 5433. Sampled events back that up. Application labels read rdp at 41 records and mssql-tds at 20, and sampled destination ports cluster in the 33031 to 33803 range. User agents spoof Firefox 3.6 builds, rv:1.9.5.20 and rv:1.9.6.20, a signature pair that no current browser sends.

Sponge holds 59 sessions in the week window, up from 42. 176.120.22.147 sent 21 and 176.120.22.89 sent 16. Ports lead with 443 at 17 and 80 at 16, then 3390 at 8. Censys sees 35 hosts, led by 22 at 12 and 3389 at 8. Two JA4 values cover the sample, t12i210600_76e208dd3e22_f28add8e7af0 and t13i251000_b78ed14e2fd0_ab7e3b40a677. The second fingerprint also appeared last week on this provider.

AS14956 (ROUTERHOSTING, RouterHosting LLC)

RouterHosting event volume rose to 147 from 59. Eighteen addresses produced them, spread across the US, Australia, the Netherlands, and Switzerland. 45.61.172.107 leads at 61 events, then 172.86.74.129 at 18, 144.172.116.147 at 9, and 167.88.168.121 at 9.

Target ports name database and file-sharing services: 6380, 1521, 6379, 445, 10443, 443, 5432, 8080, 80, and 44300. Sampled events show 445 at six records, 5432 at three, and 8000 at three. Application labels read http at 17, smbv1 at 2, redis at 2, and smtp at 1. The user agents are Mozilla/5.0 zgrab/0.x and curl/8.5.0, which is scanner tooling that does not hide itself.

RouterHosting also added the most new addresses to this week’s union, at 21 of 64. One JA4 value appears on six events, t13i1909h2_9dc949149365_97f8aa674fd9, and it did not appear last week.

Sponge holds 399 sessions, up 6 percent. 172.86.87.202 sent 79 and 144.172.88.96 sent 68. Destination ports lead with 5060 at 82, 2222 at 45, and 22 at 33. Censys sees 25,709 hosts, down 456, led by 22 at 15,504, 443 at 9,068, 80 at 8,082, and 3389 at 6,957. The host count fell while sessions and events rose, so the traffic came from existing hosts.

AS200651 (FLOKINET)

FlokiNET returned 47 events, up 67.9 percent from 28, from two addresses. 185.146.234.178 sent 27 and 185.100.87.136 sent 20. Target ports are 3000, 443, 8080, 444, and 2222, which fits one host with a web service on 3000 and SSH on 2222.

Sponge holds 102 sessions in the week window, down from 327. 185.100.87.136 sent 81 and 185.146.234.178 sent 37. Destination ports lead with 443 at 54, 3000 at 37, and 444 and 2222 at 9 each. The same two addresses appear in both sources, so the provider shows one small operator rather than a scanner pool.

Censys sees 4,431 hosts, up 213, led by 22 at 3,400, 443 at 2,392, and 80 at 2,224. Mail ports hold a visible share: 25 at 284, 587 at 224, and 993 at 219.

Infrastructure Correlation

The Pfcloud clone persists. Four hosts, 204.76.203.37, .38, .44, and .53, expose the same 12 services: 22, 80, 81, 443, 7070, 7781, 8123, 9000, 9004, 9005, 9009, and 25566. All four run caddy, flask, and clickhouse, and all four serve the SSH host key 5d74b972b1a82484596aca537381c8c66901d3aae0ef5140d9a297b7557ebed5. The prior run attributed that key to five hosts. The count fell by one while the configuration held. Three of the four carry a Censys Greynoise label of malicious, and 204.76.203.53 carries tags for MySQL, SOCKS5 proxy, and telnet scanning.

The same subnet holds single-purpose nodes. 204.76.203.4 and 204.76.203.231 expose SSH on 22 and nothing else, each with a distinct host key, and both carry suspicious Greynoise labels. Both produced thousands of honeypot events. A host that Censys sees as SSH-only can still run a full scanner.

Three addresses carry most of their ASN’s Sponge traffic while Censys sees no services: 176.65.148.253 with 4,486 sessions, 204.76.203.195 with 1,503, and 176.120.22.61 with 6. A zero-service record at Censys means one of two things. Either the scanner ran while the host blocked inbound probes, or the scan window missed the open ports.

Source coverage diverges. 109.120.179.192 produced 8,816 Honeylabs events and zero Sponge sessions. Sponge watches the destination fleet and Honeylabs watches a separate sensor set, so a host that probes one and not the other is expected. Read either source alone and this host looks either absent or dominant.

The two large Sponge drops trace to named hosts. PROSPERO-AS fell from 18,012 to 6,584 sessions because 91.202.233.49 fell from 13,708 to 4,293. PLI-AS fell from 11,728 to 7,016 because 179.43.167.3 fell from 7,185 to 4,424 and 190.211.252.4 fell from 3,417 to 1,548. Both pairs keep the same shape, with the sessions spread across random high ports, so the volume changed while the method held.

One provider moved the other way. Datashield, Inc. (AS211720) rose from 662 to 1,166 sessions, up 76 percent, on two observed addresses. Censys sees 60 hosts for the provider. Censys host count for RU-AEZA-AS (AS216246) rose to 9,017 from 8,397, and Hostkey (AS57043) rose to 108,806 from 106,754. InvisionTech Group (AS216309) fell to one host from 38.

Fleet Observations

The Censys fleet grew to 270,498 hosts from 266,732. The top-20 service buckets sum to 554,331 against 550,405.

Port shares held within a quarter point. Port 22 leads at 35.6 percent against 35.5, port 443 sits at 22.9 against 22.9, and port 80 sits at 15.7 against 15.5. Port 2096, a Censys scan port, holds 5.3 percent against 5.3. Port 8443 holds 3.9 against 3.9.

The protocol mix moved less than one point in share. HTTP holds 50.6 percent against 50.1, SSH 25.2 against 25.3, and UNKNOWN 6.6 against 7.3, a fall of 8.4 percent in count. VNC rose to 6.2 from 5.9. RDP holds 1.6, SMTP holds 1.6, and SOCKS holds 1.2.

Software shares are stable. OpenSSH holds 37.6 percent against 37.7, nginx 27.6 against 27.7, and google_web_services 3.6. Caddy rose to 14,238 services from 13,406, a 6.2 percent gain, and it now ranks fifth. Express fell 3.7 percent to 13,261. Linux covers 93.5 percent of hosts with an operating system, up from 93.4. Windows holds 3.6.

Certificate issuers fell in absolute count. The top-20 bucket sum dropped to 161,559 from 168,043 while the host count rose. YE2 leads at 20.6 percent against 21.1, YE1 holds 20.0 against 20.7, and the invalid2.invalid placeholder rose to 11.9 from 11.5. YR1 rose to 7.9 from 7.4 and YR2 fell to 6.5 from 6.8. Fewer certificates fall inside the top-20 issuer set, and more of those certificates come from the placeholder or from YR1.

IoCs and Detection Guidance

Sixty-four addresses appeared this week and 79 dropped off, against 152 observed addresses in total. The union draws on Honeylabs enrichment, top-attacker lists, event samples, and Sponge top sources. RouterHosting added 21, Hostkey 12, Pfcloud 7, and AEZA 7.

Proxy-check traffic through HTTP CONNECT now names new IP-echo endpoints. The sample holds icanhazip.com:443 at 10 requests, api.ipinfo.io:443 at 9, and api.i.pn:443 at 7. Prior weeks carried icanhazip.com and httpbin.org. A host that opens CONNECT to an IP-echo service is testing whether a proxy exit works. Block the pattern at the proxy, not at the destination.

Other paths in the sample: /remote/login?lang=en at two requests, the FortiGate SSL-VPN login page, plus /hello, /health, and /wiki.css.

Scanner user agents worth blocking: Mozilla/5.0 zgrab/0.x, curl/8.5.0, Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.20, and Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/5.0. The last two spoof browsers from 2009 and 2011, and Proton66 sends both.

TLS fingerprints from the sample:

• JA4 t13i1909h2_9dc949149365_97f8aa674fd9 on three RouterHosting sources, six events, absent last week.
• JA4 t12i210600_76e208dd3e22_f28add8e7af0 on one Proton66 source, two events.
• JA4 t13i251000_b78ed14e2fd0_ab7e3b40a677 on one Proton66 source, two events, also seen on the provider last week.
• JA4 t13i1310h1_f57a46bbacb6_e7c285222651 on two sources across PLI-AS and RouterHosting, two events.
• JA4 t13i190800_9dc949149365_97f8aa674fd9 on one RouterHosting source, one event. The prior run recorded the same value on a Pfcloud host.

No SSH client HASSH appears in this week’s sample, against two last week. Treat that as sample size, not as a change in tooling.

Hosts to watch:

• 109.120.179.192 for the AEZA burst.
• 204.76.203.4 for sustained Pfcloud volume.
• 204.76.203.37, .38, .44, and .53 for the shared SSH key and cloned service set.
• 45.61.172.107 for RouterHosting database probing.
• 176.120.22.61 for RDP and MSSQL targeting.

The full IP list, fingerprint list, and request-path list sit in the run data: https://rud.is/git/gists.git/tree/kevlar/2026-10-26/