org: (none matched in census): Sponge IP 45.144.28.70 actually in AS41745 FORTIS-AS - Baykov Ilya Sergeevich (RU)

software_top: openssh nginx python aiohttp dovecot bind exim google_web_services proftpd app_and_api_protector ghost http_server waf cloudflare_load_balancer uvicorn caddy express node_exporter fastpanel php

cert_issuers_top: Sectigo Public Server Authentication CA DV E36 63

cert_issuers_top: DigiCert Global G2 TLS RSA SHA256 2020 CA1 44

cert_issuers_top: DigiCert Global G3 TLS ECC SHA384 2020 CA1 43

cert_issuers_top: GlobalSign Atlas R3 DV TLS CA 2025 Q3 75

per_ip_whois: Baykov Ilya Sergeevich (RU), network created 2026-06-06 (very recent)

per_ip_censys_asn: 41745 FORTIS-AS

per_ip_greynoise: malicious -- tags: Web Crawler, HTTP OPTIONS Crawler, Go HTTP Client, Generic Brute Force Attempt, Generic Login Attempt, TLS/SSL Crawler

per_ip_services_running: OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 (single service, no web)

notes: Real ASN has 4087 censed hosts -- AS209847 viewpoint is via Sponge/IPv4 routing only; BULLETPROOF label is on IP not on AS-census IP pool. 998 Sponge sessions = scanning across many HTTPS ports. Critical new infra


org: KAOPU Cloud HK Limited

cert_issuers_top: GlobalSign Atlas R3 DV TLS CA 2025 Q3 114

cert_issuers_top: Sectigo Public Server Authentication CA DV E36 104

notable_unusual: IPv6 support 1 host (vs 0 prior) -- no IPv4 multi-cast shift user notable. Sponge top IP 38.54.2.209 fires 51,461 sessions (cap exceeded) -- NTP/SSDP/LLMNR amplification suspected


org: Kprohost LLC

per_ip_whois: Lanedonet Datacenter (NL); network 77.83.39.0/24 created 2025-12-17

per_ip_greynoise: malicious -- tags: Web Crawler, TLS/SSL Crawler, ENV Crawler, GoogleBot Pretender, Java HTTP Client

per_ip_hassh_server: 41ff3ecd1458b0bf86e1b4891636213e -- OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 -- SAME as AS209847/FORTIS, AS51852/PLI, AS216139 -- uniform Ubuntu 22 LTS across bulletproof providers


org: ZhouyiSat Communications

software_top: http_api openssh http_server nginx virtual_environment internet_information_services anydesk php asp.net fastpanel dovecot exim mariadb mysql openresty parallels_plesk_panel plesk postfix proftpd

notes: Pure WINDOWS administration recon profile: WinRM(5985/47001+5986), RPC(135), SMB(445+139+137), WMI(5357). Linux only 40 hosts. Confirms prior-week /.env scanner has shifted to broader Windows-server brute-expansion -- the absence of honeypot events this week doesn't mean quiet, just that their scanning hit fewer honeypots


org: Prospero Ooo

notes: Asn query returned 0 hosts in Censys this week -- vanished from public scanscape (anonymized/withdrawn). Yet Honeylabs sees 91.202.233.79 (TM) generating 968 brute events, plus 1 hit from 91.215.85.104 (RU) with Python aiohttp UA. Honeylabs UA last week: 9 sources; this week mostly same scan bomb rapid-fire on diverse high-numbered ports (3558/3392/3636/6666/3388). Cross-source anomaly -- they are running tools from an IP that is no longer visible in Censys


org: Private Layer INC

cert_issuers_top: Sectigo Public Server Auth CA DV E36 105

per_ip_whois: Private Layer INC (PANAMA-based); 81.17.28.128/27 -- previously unseen host

per_ip_dns: none (blank rDNS through Sponge)

per_ip_ssh_hassh_server: 41ff3ecd1458b0bf86e1b4891636213e (OpenSSH_8.9p1 Ubuntu-3) -- same HASSH as AS214940, AS209847/FORTIS

per_ip_greynoise: unclassified


org: RouterHosting LLC

cert_issuers_top: Sectigo Public Server Authentication CA DV E36 285

per_ip_whois: RouterHosting LLC (Cloudzy-branded Wyoming shell). 216.126.239.0/24 reg 2025-06-25 (recent)

per_ip_ssh_hassh_server: e42184b06d45385a906f0803d04c83da (OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 -- quite modern; not vulnerable to regreSSHion)

per_ip_service_5000_werkzeug: Werkzeug 3.1.8 + Python 3.12.3 with HTTP 401 Basic realm="fofa_monitor" -- a fofa-search-style monitoring panel exposed (rare; Censys flagged Unencrypted HTTP Weak Auth HIGH)

per_ip_known_cve_high: CVE-2024-6387 (regreSSHion, KEV)

notes: Substantial cPanel/Plesk/cPanel-ghost stack + multi-platform honeypot reconnaissance. cPanel/cPanel stack fully populated. Highly aggressive on multi-CVE exploit testing. Note the fofa_monitor panel -- new addition to scan infrastructure.


org: Aeza Group LLC

notes: Massive infrastructure drop from 6800 -> 0 census hosts -- AS has withdrawn from Internet-visible scanscape entirely. 11 Sponge sessions remaining from 5 IPs. Honeypot data: 0 events. Pattern: Aeza may have shifted IPs to a different AS (or simply turned off public-facing ports entirely). Status: full infra blackout / migration suspected.


org: Datashield, Inc.

per_ip_whois: Datashield Inc -- Mikail Gairbekov admin (SEYCHELLES); PO BOX 121 Victoria Mahe

per_ip_dns: none public

per_ip_location: Switzerland -- ZUG (Seychelles-owned, Sweden registered-loc

per_ip_service_443_cert: SELF-SIGNED -- subject CN=prohaska.beatty.biz, O=Prohaska-Beatty, OU=compress, ST=HI, C=US, email compress@prohaska.beatty.biz -- a fake US business entity (no domain eponym)

per_ip_misconfigurations: CENSYS-2024-1026 No Trusted Path Certificate

per_ip_misconfigurations: CENSYS-2022-1013 Downgrade Attack Possible (TLS 1.0/1.1 still enabled)

notes: Previously conducting Exchange /ews/ recon (week 2026-07-13). This week shifted to MSSQL TDS port 1433 only -- a domain SQL database password bruteforce probe set. Source hostname 'short-tan-rat' hardcoded in packets. Self-signed prohaska.beatty.biz cert still active. Continuation of datashield as an MSSQL bruteforce platform -- via TLS 1.0/1.1 enabled Oracle-level downgrade flaws


org: ANY DIGITAL PTE. LTD.

notes: 2 sponge sessions from 2 IPs (154.94.68.6, 204.3.179.2) on port 0 -- trivial activity. Conservative observe: catalog-listed but no census coverage yet -- AS poised for infr ready in the future.