Autonomous system
AS51396 PFCLOUD
Hosting Spamhaus ASN-DROP RIPE
Summary
Pfcloud UG
hosting lir transit-reseller
PFCLOUD is Pfcloud UG (haftungsbeschränkt), a German LIR that leases address space and resells transit to a sizeable set of small hosting networks, while originating a substantial block of space itself.
What it's used for
Hosting and connectivity resale. RIS observes 33 IPv4 prefixes totalling 8,448 addresses plus 39 IPv6 prefixes — the widest IPv6 footprint of any network in this size class — reached through 33 upstreams.
The distinctive feature is the customer cone: 22 downstream ASNs, including AS197170 (TechTies), AS203027, AS212094, AS214940 and AS58232. PeeringDB self-labels the network "Network Services", Europe, 100-200Gbps, which fits an LIR selling space and transit rather than a pure server host.
Notable
- A classification on this ASN does not reach its customers. Pfcloud's 22 downstream ASNs originate their own prefixes; labelling AS51396 only labels space AS51396 itself announces. Each downstream is judged on its own evidence — AS197170 was, separately.
- It sits behind 33 upstreams of its own, so despite the customer cone this is a reseller rather than a backbone. Tier-1 it is not.
- Pfcloud recurs as the upstream of newly-registered hosting shells. When one of its customers turns up in a report, Pfcloud is usually one of the two or three transit providers listed.
Interesting
- Reputation is substantial: listed in Spamhaus ASN-DROP under
pfcloud.io,176.65.148.0/22in Spamhaus DROP as SBL679272, and an FBI IC3 indicator in the space at176.65.149.100— advisory 250912, UNC6040 and UNC6395 compromising Salesforce instances for data theft and extortion (2025-09-12). - The AS number was registered on 2023-12-08, which is recent for a network with a 22-ASN customer cone. Growth of that shape in under two years is characteristic of IPv4 leasing rather than organic hosting growth.
pfcloud.iosits behind a Cloudflare interstitial that does not render for automated fetches, so the product catalog cannot be read directly the way most hosts' can. Registry data, PeeringDB and the customer cone are what describe this network.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 2 exchanges in 2 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| ERA-IX Amsterdam | Amsterdam, Netherlands | 185.1.240.6 |
| ERA-IX Frankfurt | Frankfurt, Germany | 185.0.27.24 |
Transit providers
15 upstream, 20 downstream and 48 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-10, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 26 prefixes · 7.94K addresses IPv6 26 prefixes
| Country | Name | Prefixes |
|---|---|---|
| DE | Germany | 52 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS51396- Registry name
- PFCLOUD
- Registrant
- lir-de-pfcloud-2-MNT
- Abuse contact
- abuse@pfcloud.io
- Registered
- 2023-12-08
- Last changed
- 2025-12-18
- Allocation
- allocated
Routing security
RPKI and IRR
- RPKI
- 94% valid · 68 valid, 3 with no ROA 1 RPKI-invalid
- ROAs
- 68 authorising AS51396
- ASPA
- 9 declared providers
- IRR
- 94% registered · 68 of 72 announcements
- Route objects
- 81 naming AS51396
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
On Spamhaus ASN-DROP Spamhaus lists this entire
network (associated domain pfcloud.io)
as controlled by, or hijacked for, cybercrime. Many operators null-route
everything it originates.
17 DROP matches Announced space overlapping the DROP prefix list.
| Announced | DROP entry | Record |
|---|---|---|
| 23.176.184.0/24 | 23.176.184.0/24 | SBL688276 |
| 45.135.193.0/24 | 45.135.193.0/24 | SBL679273 |
| 45.135.194.0/24 | 45.135.194.0/24 | SBL679271 |
| 45.144.212.0/24 | 45.144.212.0/24 | SBL673344 |
| 77.83.39.0/24 | 77.83.39.0/24 | SBL690639 |
| 176.65.134.0/24 | 176.65.134.0/24 | SBL689704 |
| 176.65.148.0/22 | 176.65.148.0/22 | SBL679272 |
| 176.65.148.0/22 | 176.65.149.0/24 | SBL676058 |
| 204.76.203.0/24 | 204.76.203.0/24 | SBL673234 |
| 217.60.241.0/24 | 217.60.241.0/24 | SBL697916 |
| 217.60.250.0/24 | 217.60.250.0/24 | SBL694808 |
| 2a05:b0c6:a200::/39 | 2a05:b0c6:a200::/39 | SBL639451 |
| 2a05:b0c7:6000::/36 | 2a05:b0c7:6000::/36 | SBL639452 |
| 2a12:6740::/29 | 2a12:6740::/30 | SBL654214 |
| 2a14:7c2::/31 | 2a14:7c2::/32 | SBL648565 |
| 2a14:7c2::/31 | 2a14:7c3::/32 | SBL641930 |
| 2a14:8000::/29 | 2a14:8000::/29 | SBL690641 |
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 431 networks and 1,775 prefixes, as published 2026-10-11. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere