Post #4139274
2026-07-27 11:54 UTC
Bulletproof hosting report for Jul 21-27 using intel from @HoneyLabs@infosec.exchange, @censys@infosec.exchange, and my tiny fleet.
Pfcloud dominated w/2,500+ events from 39 IPs & fleet correlation that's interesting: multiple IPs share the exact same SSH HASSH fingerprint + OpenSSH 9.6p1 configs.
Proton66 re-emerged w/544 events running Redis & MSSQL scanning campaigns. Aeza Group's 3x-ui panel hit Censys THREAT-521. RouterHosting probed SMB, SIP, & port 541 across 12 IPs.
Full breakdown + IoCs: https://ai.rud.is/posts/2026-07-27-weekly-bulletproof-report
1/2
Replies (1)
-
@hrbrmstr@mastodon.social 2026-07-27 11:58
Aeza Group is running 3x-ui proxy panels + actively fingerprint-randomizing (diff. JA3 per HTTP request to the same host). Same IP probed VPN appliance paths: Pulse Secure, GlobalProtect, Citrix, Guacamole. Kaopu Cloud HK generated >10K Sponge sessions but almost zero Honeylabs events. This might mean their traffic targets specific networks, not global honeypots. Paired w/unusual high-port exposure (32080, 43080, 40003-40810) from prior wks. A few BPH ASNs were super quiet. Vacation time? 2/2