Executive Summary
Honeylabs recorded 51,557 events from the 25 watched ASNs this week, up 59.2 percent from 32,387. The rise concentrates in two providers. PROTON66 (AS198953) jumped from 1,348 to 20,611 events, and one host, 176.120.22.179, sent 19,010 of them. ROUTERHOSTING (AS14956) rose from 147 to 6,104 events, led by 45.61.178.105 at 5,677. PFCLOUD (AS51396) stayed the largest single source at 24,566 events, up 12.0 percent.
Sponge recorded 134,912 sessions inside the week window, down 28.8 percent from 189,451. The decline is not fleet-wide. KAOPU-HK (AS138915) held 72,366 sessions on reflection-style UDP ports, and PFCLOUD held 44,184. The big mover in the other direction is THE (AS209847): 31 sessions last week, 9,085 this week, almost all from one host on one day. Sensor coverage is not constant, so read the fleet figure as an upper bound on the real decline.
Censys matched 274,259 hosts, up 1.4 percent from 270,498. Fleet shares barely moved: port 22 leads at 200,163 services, then 443 at 128,385 and 80 at 86,433. Five Pfcloud hosts still share one identical 12-port service layout, a cloned-infrastructure signal that persists week over week.
By the Numbers
Sponge sessions count exact session totals for the 2026-10-26 to 2026-11-02 window, taken per ASN from the session indices. Events come from asn_enrich.total_events over the same window. Top port comes from the Censys per-ASN port aggregate, which counts every service on matching hosts. The change column follows event volume when a provider reported events in either week, and Sponge sessions otherwise.
| ASN | Provider | IPs Observed | Sponge Sessions (week) | Events | Top Port | Change vs Prior Week |
|---|---|---|---|---|---|---|
| AS138915 | KAOPU-HK (Kaopu Cloud HK Limited) | 20 | 72,366 | 0 | 22 | -6.6% |
| AS51396 | PFCLOUD (Pfcloud UG) | 33 | 44,184 | 24,566 | 22 | +12.0% |
| AS209847 | THE | 4 | 9,085 | 0 | 22 | +29,106% |
| AS200593 | PROSPERO-AS | 6 | 4,813 | 0 | 22 | -28.8% |
| AS51852 | PLI-AS | 18 | 2,232 | 41 | 22 | +310.0% |
| AS211720 | Datashield, Inc. | 2 | 937 | 0 | 22 | -23.3% |
| AS200651 | FLOKINET | 7 | 634 | 173 | 22 | +268.1% |
| AS14956 | ROUTERHOSTING (RouterHosting LLC) | 34 | 233 | 6,104 | 22 | +4,052.4% |
| AS214940 | KPRONET | 2 | 177 | 0 | 22 | +94.5% |
| AS198953 | PROTON66 | 8 | 154 | 20,611 | 22 | +1,429.0% |
| AS57043 | HOSTKEY-AS | 12 | 45 | 0 | 22 | -100.0% |
| AS214351 | FEMOIT | 1 | 31 | 52 | 22 | new |
| AS210644 | AEZA-AS | 7 | 11 | 10 | 22 | -99.9% |
| AS30823 | AUROLOGIC (aurologic GmbH) | 1 | 6 | 0 | 22 | -84.6% |
| AS33993 | UFO-AS | 1 | 4 | 0 | 22 | +300.0% |
| AS216139 | IRONHOST | 0 | 0 | 0 | 22 | 0.0% |
| AS400992 | ZHOUYISAT-COMMUNICATIONS | 0 | 0 | 0 | 22 | 0.0% |
| AS213702 | QWINS-LTD | 0 | 0 | 0 | 22 | -100.0% |
| AS216246 | RU-AEZA-AS | 0 | 0 | 0 | 22 | -100.0% |
| AS140666 | ADPL-AS-AP (ANY DIGITAL PTE. LTD.) | 0 | 0 | 0 | 443 | -100.0% |
| AS206728 | MEDIALAND-AS | 0 | 0 | 0 | 443 | 0.0% |
| AS216309 | INVISIONTECH-GROUP-SRL | 0 | 0 | 0 | 22 | 0.0% |
| AS58854 | KAOPY (Kaopu Cloud) | 0 | 0 | 0 | 8887 | -100.0% |
| AS202685 | TR-ARKEL | 0 | 0 | 0 | 80 | 0.0% |
| AS394711 | KORGRID (KorGrid LLC) | 0 | 0 | 0 | 80 | 0.0% |
Event sampling is partial this week. The per-ASN event pull returned 503 records, and counts in the table come from the server-side aggregate, not the sample.
Per-Provider Detail
AS51396 (PFCLOUD, Pfcloud UG)
Pfcloud carried 24,566 events across 56 source IPs, up 12.0 percent from 21,933. The busiest sources are 204.76.203.231 at 5,373 events and 204.76.203.4 at 3,432. Target ports lead with 25565 Minecraft, then 80, 8080, 443, 81, and 32400. The mix points to game-server and proxy discovery rather than a single product exploit.
Sponge volume fell harder, from 96,121 sessions to 44,184. One host, 204.76.203.4, holds 16,662 of them. A second tier of .38, .40, .43, .44, and 176.65.148.233 sits between 1,886 and 2,396 each. The six high-volume nodes from two weeks ago (.212, .213, .214, .221, .222, and 176.65.148.227) are all gone from the top tier. Destination ports lead with 80 at 820, 8080 at 567, 22 at 537, and 25565 at 521.
Censys shows the cloned layout directly. Hosts 204.76.203.38, .40, .43, .44, and .53 each expose the same 12 ports: 22, 80, 81, 443, 7070, 7781, 8123, 9000, 9004, 9005, 9009, and 25566. Identical port sets on adjacent addresses fit template-deployed infrastructure.
AS198953 (PROTON66)
Proton66 returned 20,611 events, up from 1,348. One host, 176.120.22.179, sent 19,010 of them, and 176.120.22.61 added 1,084. Target ports lead with 23 Telnet, then 9001, 10433, 1443, and 1666. That port set matches classic IoT botnet recruitment traffic rather than web exploitation.
Censys sees both lead hosts as scan-only: no open ports are visible on 176.120.22.179 or 176.120.22.61. A node with no visible services and 19,000 honeypot events in a week fits a rented scan node. Sponge recorded only 154 sessions for the ASN, so the host barely shows in network telemetry.
AS14956 (ROUTERHOSTING, RouterHosting LLC)
RouterHosting jumped from 147 to 6,104 events across 18 source IPs. 45.61.178.105 alone sent 5,677, and Censys shows that host exposing only SSH on port 22. The next sources, 172.86.127.174 at 162 and 144.172.106.107 at 80, trail far behind. Target ports lead with 443, 80, 6000, 2323, 1433, and 445, a router-admin and database mix. The event sample carries a RouterAudit/1.0 user agent, which names the tooling directly.
Sponge volume fell from 410 to 233 sessions. The top source there is 144.172.91.17 at 64, with destination ports 2222 and 22 leading. The Sponge and Honeylabs views disagree on the leader, which fits different vantage points: Sponge sees raw sessions, Honeylabs sees honeypot interactions.
AS138915 (KAOPU-HK, Kaopu Cloud HK Limited)
Kaopu recorded 72,366 Sponge sessions but zero Honeylabs events, the same split as last week. One host, 38.54.2.209, holds 43,101 of the sessions, with 38.54.2.232 at 14,336. Destination ports lead with 123 NTP at 14,391, 1900 SSDP at 10,544, 5355 and 5353 mDNS, and 137 NetBIOS. That profile is reflection and amplification probing, not interactive attack traffic, which explains the absence from the honeypot data.
AS209847 (THE)
THE went from 31 sessions to 9,085, and the daily timeline shows why. On 2026-10-31 alone the ASN produced 9,071 sessions, against single digits on the other days. One host, 171.22.129.223, accounts for 9,069 of them, all to destination port 29000. A single host, single day, single port burst looks like a one-off scan or a sensor event, not a sustained campaign. Honeylabs recorded no events for the ASN in the window.
Infrastructure Correlation
The Pfcloud cluster remains the clearest cross-week signal. Five adjacent hosts in 204.76.203.0/24 expose byte-identical port layouts, and the same range supplies most of the ASN’s Honeylabs events. The prior week’s six high-volume scan nodes in that range rotated out, so the activity now comes from a smaller set of hosts.
PROTON66’s two lead hosts are scan-only nodes with no Censys-visible services. That pairing, high honeypot volume plus empty port scans, marks rented attack infrastructure rather than hosting customers.
The IP union across all sources holds 159 addresses this week, against 152 last week. Eighty-four are new and 77 dropped out. New addresses cluster in PFCLOUD’s 176.65.149.0/24, PLI-AS’s 179.43.150-186 ranges, and ROUTERHOSTING’s 45.61.x range, matching the providers with rising event counts.
Fleet Observations
Censys matched 274,259 hosts across the 25 ASNs, up 1.4 percent. Port shares are stable: 22 leads at 200,163 services, 443 at 128,385, 80 at 86,433, 2096 at 29,784, and 8443 at 22,025. Protocol shares read HTTP at 452,549 services, SSH at 224,723, UNKNOWN at 68,271, VNC at 56,310, and RDP at 13,775. Software leads with OpenSSH at 199,956, nginx at 143,466, then Google web services and a generic web_server label. Linux dominates the OS field at 183,612 hosts, with Windows at 6,776. Certificate issuers are led by the YE1 and YE2 test CAs, which together cover most TLS services on the fleet.
IoCs and Detection Guidance
Watch the single-host bursts first: 171.22.129.223 on port 29000 (AS209847), 176.120.22.179 on ports 23 and 9001 (AS198953), and 45.61.178.105 on ports 443 and 6000 (AS14956). The Pfcloud 204.76.203.0/24 cluster, especially .4, .38, .40, .43, .44, .53, and .231, remains the densest source of mixed scanning and proxy enumeration. The RouterAudit/1.0 user agent and the JA4 t13i311000_e8f1e7e78f70_d41ae481755e fingerprint appeared in this week’s event sample on 56 events.
Sampled paths worth blocking at the edge include /Guest.aspx, /cgi-bin/get_miner_info.cgi, /cgi-bin/get_system_info.cgi, and /apply_sec.cgi?cmd=backup.
The full data set for this run is at https://rud.is/git/gists.git/tree/kevlar/2026-11-02/.