AS51396 — PFCLOUD Pfcloud UG (haftungsbeschrankt)

Network type: hosting

AS51396 announces 24 IPv4 prefixes covering 7,424 addresses and 24 IPv6 prefixes.

About this network

PFCLOUD is Pfcloud UG (haftungsbeschränkt), a German LIR that leases address space and resells transit to a sizeable set of small hosting networks, while originating a substantial block of space itself.

What it's used for

Hosting and connectivity resale. RIS observes 33 IPv4 prefixes totalling 8,448 addresses plus 39 IPv6 prefixes — the widest IPv6 footprint of any network in this size class — reached through 33 upstreams.

The distinctive feature is the customer cone: 22 downstream ASNs, including AS197170 (TechTies), AS203027, AS212094, AS214940 and AS58232. PeeringDB self-labels the network "Network Services", Europe, 100-200Gbps, which fits an LIR selling space and transit rather than a pure server host.

Notable

• A classification on this ASN does not reach its customers. Pfcloud's 22 downstream ASNs originate their own prefixes; labelling AS51396 only labels space AS51396 itself announces. Each downstream is judged on its own evidence — AS197170 was, separately.
• It sits behind 33 upstreams of its own, so despite the customer cone this is a reseller rather than a backbone. Tier-1 it is not.
• Pfcloud recurs as the upstream of newly-registered hosting shells. When one of its customers turns up in a report, Pfcloud is usually one of the two or three transit providers listed.

Interesting

• Reputation is substantial: listed in Spamhaus ASN-DROP under pfcloud.io, 176.65.148.0/22 in Spamhaus DROP as SBL679272, and an FBI IC3 indicator in the space at 176.65.149.100 — advisory 250912, UNC6040 and UNC6395 compromising Salesforce instances for data theft and extortion (2025-09-12).
• The AS number was registered on 2023-12-08, which is recent for a network with a 22-ASN customer cone. Growth of that shape in under two years is characteristic of IPv4 leasing rather than organic hosting growth.
• pfcloud.io sits behind a Cloudflare interstitial that does not render for automated fetches, so the product catalog cannot be read directly the way most hosts' can. Registry data, PeeringDB and the customer cone are what describe this network.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy.

Announced prefixes

• 23.176.184.0/24
• 31.40.201.0/24
• 31.57.185.0/24
• 45.135.193.0/24
• 45.135.194.0/24
• 45.144.212.0/24
• 77.83.207.0/24
• 85.208.84.0/24
• 88.214.50.0/24
• 89.45.35.0/24
• 94.183.174.0/24
• 138.249.120.0/23
• 138.249.122.0/24
• 138.249.124.0/23
• 176.65.134.0/24
• 176.65.148.0/22
• 176.223.188.0/24
• 185.197.182.0/24
• 185.235.167.0/24
• 195.216.154.0/24
• 204.76.203.0/24
• 217.60.197.0/24
• 217.60.241.0/24
• 217.60.250.0/24
• 2602:f915::/40
• 2a05:b0c6:5800::/37
• 2a05:b0c6:a200::/39
• 2a05:b0c7:6000::/36
• 2a0a:e2c0::/29
• 2a0e:4001:2000::/36
• 2a11:5780::/29
• 2a12:1cc7::/32
• 2a12:5a00::/29
• 2a12:6740::/29
• 2a12:8100::/29
• 2a12:8ec0::/29
• 2a12:ccc0::/29
• 2a12:d3c0::/29
• 2a12:e240::/29
• 2a14:7c0:40::/44
• 2a14:7c0:100::/40
• 2a14:7c0:1742::/48
• 2a14:7c0:3a00::/40
• 2a14:7c0:f400::/38
• 2a14:7c1::/32
• 2a14:7c2::/31
• 2a14:7c4::/30
• 2a14:8000::/29

Upstream networks

• AS49581 Ferdinand Zink trading as Tube-Hosting
• AS64457 Matteo Fruhwald trading as PipeHost e.U.
• AS62403 PletX GmbH
• AS6939 Hurricane Electric LLC
• AS34779 T-2, d.o.o.
• AS50304 Blix Solutions AS
• AS50263 A-Systems Sp. z o.o.
• AS24482 SG.GS
• AS12859 BIT BV
• AS8218 Zayo Infrastructure France SA
• AS35133 Eranium B.V.
• AS34927 iFog GmbH
• AS20764 CJSC RASCOM
• AS13030 Init7 (Switzerland) Ltd.
• AS50629 LWLcom GmbH

Downstream networks

• AS214413 WYOCORE TECHNOLOGIES LLC
• AS218751 Fontaine, LLC
• AS209809 ROCO HOST LTD
• AS214865 Falco Nordmann
• AS205211 Tilen Barbiric
• AS219032 Papilio Host Ltd
• AS198189 Throttle Limited
• AS219097 Fanth sp. z o.o.
• AS212094 Andre Schmidt
• AS208068 Ludwig Moritz Hodiamont
• AS198364 BANATSYNC SRL
• AS64457 Matteo Fruhwald trading as PipeHost e.U.
• AS216215 Xantho UAB
• AS212890 ONEMAN NETWORK LIMITED
• AS203156 Relayify LLC
• AS202412 Omegatech LTD
• AS209373 SWISSNET LLC
• AS197769 VPS Dedicated LLC
• AS210577 Tobias Manfred Wegner
• AS214940
• AS215460 Daniel Mishayev

Adjacent networks

• AS49581 Ferdinand Zink trading as Tube-Hosting
• AS6939 Hurricane Electric LLC
• AS62403 PletX GmbH
• AS214413 WYOCORE TECHNOLOGIES LLC
• AS64457 Matteo Fruhwald trading as PipeHost e.U.
• AS34779 T-2, d.o.o.
• AS218751 Fontaine, LLC
• AS209809 ROCO HOST LTD
• AS214865 Falco Nordmann
• AS205211 Tilen Barbiric
• AS219032 Papilio Host Ltd
• AS198189 Throttle Limited
• AS219097 Fanth sp. z o.o.
• AS212094 Andre Schmidt
• AS208068 Ludwig Moritz Hodiamont
• AS198364 BANATSYNC SRL
• AS50304 Blix Solutions AS
• AS50263 A-Systems Sp. z o.o.
• AS216215 Xantho UAB
• AS35133 Eranium B.V.
• AS197769 VPS Dedicated LLC
• AS203156 Relayify LLC
• AS212890 ONEMAN NETWORK LIMITED
• AS30823 aurologic GmbH
• AS24482 SG.GS

Routing security

• RPKI: 52 valid, 2 invalid and 5 not-found announcements; 56 ROAs.
• ASPA: 9 authorised providers.
• IRR: 88% of announcements registered; 74 route objects.
• Listed in as-sets: AS-CHTE, AS-COMBAHTON, AS-HURRICANEV6, AS-PFCLOUD, AS-PIPE, AS-ROSTELECOM, AS-SCALEBLADE:AS-CUST, AS-SKYLINK, AS-TUBE, AS200461:AS-V6NODE, AS204464:AS-BLACKLIST, AS214497:AS-CUST, AS215120:AS-EVOLUS, AS219097:AS-UPSTREAM, AS267690:AS-FEMBOY, AS30823:AS-AUROLOGIC, AS3216:AS-SKYLINK, AS51026:AS-MOBINHOST, AS51396:AS-PFCLOUD, AS57974:AS-CUSTOMERS.

Internet exchanges

• ERA-IX Amsterdam — Amsterdam, Netherlands
• ERA-IX Frankfurt — Frankfurt, Germany