linkage_type,ips,indicator,asn,notes
shared_service_banner,204.76.203.224+226,ClickHouse banner e5ca3ebf... on 9009 + proxy banner 16f5ca47... on 9191,AS51396,Cloned proxy infra; identical HTTP banner hashes
shared_hassh,77.83.39.6 + 204.76.203.221/214 (prior week),hassh 41ff3ecd1458b0bf86e1b4891636213e,AS51396,SSH client config shared across PFCLOUD fleet; ties .env crawler to cloned proxy infra
xray_panel_certs,YE1/YE2/YR1/YR2 across AS51396/AS57043/AS14956/AS51852/AS138915,"X-UI/Xray panel cert series (YE1=26k+, YE2=27k+, YR1=11k+, YR2=9k+ combined)",multi,Cross-ASN Xray/panel fleet; XUI.one + Gozargah issuer CNs on PFCLOUD
scan_only_nodes,154.93.119.164-169 (KAOPU 154.93.119.0/24),single HTTP service on 4083 returning 404,AS138915,Proxy/CDN node pool; no SSH
tor_relay,185.100.87.136,Onionoo fingerprint 9366185B...,AS200651,Confirmed Tor exit; random-domain TLS cert on 9001