BytePlus was launched in June 2021 as ByteDance's enterprise technology division, headquartered in Singapore. AI Business reported it as "a new division to sell its AI tech" — marketing ByteDance's internal machine learning tools to international enterprise clients.

The operational reality is different. APNIC records show:

• ASN: AS150436 (BYTEPLUS-AS-AP - Byteplus Pte. Ltd., SG)
• Abuse contact: bd_abuse@bytedance.com
• NOC contact: noc@bytedance.com
• PeeringDB: 200 IPv4 prefixes, Open peering policy
• NIC Handle: BPLA13-AP ("Byteplus Pte Ltd administrator")

The email domains are the key: @bytedance.com. Not @byteplus.com. BytePlus is not a separate entity with independent operations. It is ByteDance with a Singapore address. The abuse contact routes to Beijing.

In our earlier investigation (TI-2026-025E), we identified BytePlus as hosting the largest single-provider mdrfckr infection cluster — 46 IPs actively propagating an SSH backdoor botnet. Two were directly confirmed: 101.47.159.125 and 101.47.156.170.

The mdrfckr botnet is not sophisticated. It uses default credentials, writes to predictable paths, and has been documented since 2020. BytePlus's "inability to detect one of the simplest botnets" (as we noted in TI-2026-025B) raises a binary question:

• Option A: BytePlus cannot detect a trivial botnet running on their infrastructure → incompetence
• Option B: BytePlus detects it but does not remove it → complicity

There is no Option C.

Like Aceville (031A), BytePlus exhibits the same geo-discrepancy architecture:

• Indonesia IPs: rdap_country=ID, cymru_country=SG
• Hong Kong IPs: rdap_country=HK, cymru_country=SG
• Singapore IPs: rdap_country=SG, cymru_country=SG (genuine)

All 30 IPs, regardless of their claimed location, route through Singapore. The Indonesia and Hong Kong allocations are fiction — they exist only in RDAP records, not in BGP reality. This is the same jurisdictional wrapper technique: register IPs under different countries while routing everything through a single point, fragmenting any enforcement attempt.

Our intelligence graph reveals 110 entity links for the top BytePlus IP alone:

• 53 shared_otx_pulse — appears in same threat intelligence feeds as Russian bulletproof hosts, Yisu Cloud, and compromised endpoints worldwide
• 25 shared_abuse_phone — shares abuse phone with 25 other entities
• 25 shared_rdap_org — NIC handle BPLA13-AP connects to all BytePlus blocks
• 3 registered_by — "Byteplus Pte Ltd administrator", "IRT-BYTEPLUS-SG"
• 1 resolves_to → bytedance.com

The shared_otx_pulse connections are particularly revealing: BytePlus IPs appear in the same AlienVault threat feeds as known bulletproof infrastructure from Yisu Cloud (154.83.12.193, HK) and Russian hosts (Digit One LLC). This places BytePlus infrastructure in the same threat ecosystem as acknowledged bad actors.

BytePlus advertises 200 IPv4 prefixes on PeeringDB. Our honeypot has captured only 30 IPs — a fraction. The per-IP abuse rate is what matters: 100% of tracked BytePlus IPs carry maximum AbuseIPDB confidence. No legitimate cloud provider achieves this.

For comparison:

• AWS average abuse confidence: ~15-20%
• DigitalOcean average: ~25-35%
• Tencent/Aceville (031A): 86% at ≥80
• BytePlus: 100% at maximum (100)

This is not a hosting provider with some bad customers. This is infrastructure where abuse is the norm, not the exception.