linkage_type,ips,indicator,asn,notes
cloned-image,204.76.203.213; 204.76.203.221; 204.76.203.222,identical SSH algorithm selection + banner comment "Ubuntu-3ubuntu0.17" + OpenSSH 8.9p1 single-service profile,AS51396,PFCLOUD /29 scanner fleet in Eygelshoven NL; 1100+ Honeylabs events each; BULLETPROOF-labeled
identical-service-config,45.61.157.82; 144.172.108.79; 144.172.99.200,Windows RDP (3389) + HTTP API 2.0 on 47001; 144.172.108.79 also MSSQL 2008 (10.0.1600) on 1433,AS14956,ROUTERHOSTING RDP-access fleet Las Vegas/Ogden US; BULLETPROOF-labeled
remote-access-node,176.120.22.61,Windows + RDP 3389 + WinRM 5985 + DCERPC 135,AS198953,PROTON66 St Petersburg RU; 1597 Honeylabs events; Censys BULLETPROOF label
scan-only-node,193.143.1.66,zero open ports visible to Censys,AS198953,PROTON66; 24 Honeylabs events but no exposed services
tor-exit,185.100.87.136,Censys TOR label + SSH 9.9 on non-standard port 7288,AS200651,FLOKINET Bucharest RO; 24 Honeylabs events; BULLETPROOF-labeled
ssh-fingerprint-family,204.76.203.213; 204.76.203.221; 204.76.203.222; 185.246.217.150,identical SSH algorithm selection (curve25519-sha256@libssh.org / ecdsa-sha2-nistp256 / aes128-ctr / hmac-sha2-256),AS51396; AS210644,shared SSH hardening baseline across PFCLOUD and AEZA fleets