org: Proton66 OOO

country: RU

os: windows

protocol: DCERPC

note: MS-SCMR/MS-SAMR/MS-RPRN bindings exposed; REMOTE_ACCESS label

protocol: NETBIOS

note: exposed

protocol: RDP

note: self-signed CN=M051108 SHA1-RSA cert, valid to 2027-02-12; screenshot captured

protocol: WINRM

note: Microsoft-HTTPAPI/2.0 404

note: mssql-tds sweeper (598 events this week); box itself fully exposed; unchanged from prior week


org: aurologic GmbH

country: DE

protocol: LDAP

note: AD rootDSE leaks domain ad.reiscrew.de, host erp01, USN 21300127

protocol: HTTPS

note: IIS 10.0 default page; self-signed CN=erp01.ad.reiscrew.de

protocol: SMB

note: SMB 3.0.2, NTLM, target name AD; critical exposure CENSYS-2022-1063

note: RDSTLS restricted-admin; self-signed cert renewed 2026-08-16

note: Windows Server 2016 AD domain controller for reiscrew.de; doubles as RDP masscan (Cookie: mstshash=hello, 455 events). Compromised corporate DC running from aurologic 'Network used for hosting/infrastructure' 45.11.18.0/24


org: Pfcloud UG / Intelligence Hosting LLC

country: NL

os: ubuntu

protocol: SSH

note: OpenSSH 9.6p1 Ubuntu; hassh e42184b06d45385a906f0803d04c83da

protocol: HTTP

note: nginx/1.24.0 Ubuntu 403

greynoise: malicious; tags: Ivanti/Pulse Secure/F5 BIG-IP/CrushFTP/Sophos scanners, Open Proxy Scanner, SOCKS5 Proxy Scanner, Wordpress Enumeration

note: proxy-validation node: azenv.net + httpbin.org CONNECT + socks5 judges; whois shows Intelligence Hosting LLC behind PFCLOUD 204.76.203.0/24


org: RouterHosting LLC (Cloudzy)

protocol: IKE

note: VPN endpoint (IKEv1 accepted proposal)

note: hostname sasradius, vendor xelerance.com (Openswan/Libreswan)

note: Apache 2.4.29

note: libredtail-http PHPUnit eval-stdin.php sweep (99 events) + ThinkPHP RCE + Docker /containers/json probes; legacy Apache 2.4.29 with critical CVEs; L2TP VPN box


org: Private Layer INC

country: CH

note: OpenSSH 8.9p1 Ubuntu; hassh 41ff3ecd1458b0bf86e1b4891636213e

greynoise: unknown; tags: DCERPC Protocol, Ping Scanner, TLS/SSL Crawler, Web Crawler

note: SAME HASSH as PFCLOUD clone pair 204.76.203.221/214 (prior weeks) -- cross-AS shared SSH config persists. DCE/RPC + port 8899 scanner


note: marketmaker-bot scanner: mmsk-scout/mm-scout UA probing /version /pairs /v6/marketmaker/status/1 on ports 8001/8100/9000/9001


note: only live service; WinRM 5985 seen Sep 2025 only

note: .env + random-path prober (/z875 /.e9951 /s/6051) against Vite dev server port 5173


org: FlokiNET ehf

country: RO

privacy: tor exit

note: Tor exit notice page

note: non-standard SSH

protocol: UNKNOWN

note: Tor OR port

note: beacon host: POST /api/checkin (8443), GET /images/transparentpix.gif (443, TLS1.3 ChaCha20, ja4 t13i1909h2_9dc949149365_97f8aa674fd9), binary 16-byte probes; endpoint rotated from last week's /api/client/update SPARK COMMIT


org: Kaopu Cloud HK Limited

country: HK

note: 946k lifetime Sponge sessions, 43k this week, 940k+ sessions from 38.54.2.x cluster; port-sprawl farm -- HTTP listeners on nearly every scanned port; top Sponge talker in the watched set


org: Pfcloud UG

note: ClickHouse web UI

note: proxy port

protocol: MINECRAFT

note: new since 2026-04

note: proxy-fleet node; same ClickHouse+proxy profile as .224/.226 clone pair from prior weeks; 1872 events this week, idle since 08-20