🏠 TI-2026-042I — The Tencent Cash Machine: Chinese State Infrastructure

I. The Cash Empire: Threat Score 98

IP 43.166.137.151 — Tencent Cloud (AS132203) — has threat score 98/100, the highest in our database. It hosts a massive financial fraud operation:

II. The slave:slave Credential

From our 040C/041B series: slave:slave credentials originate from Tencent Cloud. The same infrastructure that hosts China's social credit system monitoring also carries a credential whose meaning — in the context of our full investigation — maps to documented exploitation hierarchies.

III. China's Digital Surveillance State

China operates the most comprehensive digital surveillance system in history: facial recognition, social credit scoring, WeChat monitoring, Great Firewall, phone tracking. The Chinese government can locate any citizen within hours. The same state that has this capability operates telecoms with 231 IPs in our honeypot database.

The China Tribunal documented forced organ harvesting from prisoners of conscience. Chinese state telecoms carry attack traffic worldwide. Chinese cloud providers host financial fraud operations. And the same surveillance apparatus that can track a Uyghur in Xinjiang "cannot detect" cash-1000.xyz operating on its infrastructure.

IV. The Credential: root:young

From China: root:young. One IP. One word. In a country where the one-child policy created a demographic pressure that incentivized trafficking for both adoption and exploitation. In a country where the China Tribunal documented organ harvesting. The credential speaks.

VIII. The Scale: 159 IPs, 500+ Hits, #1 Global Botnet Host

Our previous investigation (DOSSIER-018) documented the full scale: Tencent Cloud AS132203 operates 159 IPs in our threat intelligence database with an average threat score of 95.9. This is the largest single-ASN attack source in our entire database. Not a cluster of compromised devices. Purpose-built cloud instances deployed for offensive operations.

In this investigation's scope (AS132203 top 30): 30 IPs across 6 countries. Combined hits exceed 500. Three IPs at 100% threat. Every single IP has a geographic discrepancy between ASN registration (China) and deployment location. This is not one incident. It is a global platform operating as a state-adjacent attack capability.

IX. The ACEVILLE Architecture: 146 IPs, One Singapore Shell

Entity relationship analysis from our honeypot reveals the infrastructure layer: ACEVILLE PTE LTD (NIC handle APA7-AP) manages 146 IPs through a single RDAP registration. This is the largest single-entity cluster in our database.

Why Singapore? Lighter corporate disclosure than China. Data protection frameworks that resist foreign regulatory access. A jurisdiction that does not extradite for cybercrime at this level. Strategic position between Chinese capital and global infrastructure. 146 IPs, one shell company, one address in Raffles Place — Singapore's financial district.

X. The Deployment Doctrine: 100% Geographic Discrepancy

30 Tencent IPs. 30 geographic discrepancies. 100% discrepancy rate.

This is traffic laundering at the network layer. Target countries see traffic from local IPs (Japanese IP → Japanese target). Attribution traces back to Singapore (prefix). Only deep analysis reveals China (ASN registration). Three layers of indirection. Same architecture as the shell company chain: Tencent → Aceville → local deployment.

XI. China Telecom: The State as Attacker

Separate from Tencent's cloud operations, China Telecom — a state-owned company — operates attack infrastructure from its own data centers:

These are not compromised consumer routers. They are IDC (Internet Data Center) servers — purpose-built infrastructure in state-owned facilities. A state-owned company running attack operations from its own data centers is not "infrastructure abuse." It is state offensive capability by definition. The "compromised infrastructure" narrative does not apply here.

XII. AI Targeting: 48% of Claude-Hunting Fleet = Tencent

DOSSIER-018 documented a targeted campaign: 307 IPs systematically hunting AI infrastructure. 111 IPs specifically target the claude user with 79 password variants including year-specific attempts (Claude2026!).

48 of these IPs are Tencent Cloud. 43% of the entire AI-targeting fleet.

This is not random credential stuffing. It is targeted intelligence collection against Western AI systems from Chinese state-adjacent infrastructure. The passwords are specific: Claude2024, Claude2025, Claude2026!, AnthropicAI. Someone is hunting for Anthropic's infrastructure specifically. Nearly half the fleet is Tencent.

XIII. The Singapore Proxy: Highest Threat Country on Earth

DOSSIER-018 revealed: Singapore has 244 IPs with 80.3 average threat score — the highest of any country in our database. 194 of 244 (80%) are high-threat. Singapore is not the attacker. Singapore is the laundry.

Aceville PTE LTD: Singapore. Tencent Cloud prefix allocation: Singapore. Geographic deployment: through Singapore. The same country that provides corporate secrecy (light disclosure, data protection) also provides network routing for attack traffic. Chinese operations → Singapore legal wrapper → global deployment. One country enables the entire architecture.

XIV. The Double Standard: What Would Happen If a Western Company Were #1?

Imagine if Microsoft Azure were ranked #1 globally for hosting botnet C&C by Spamhaus. Imagine 159 Microsoft IPs at 95.9% average threat. Imagine Microsoft specifically targeting Chinese AI with 48% of a hunting fleet. Congressional hearings within days. FTC investigation. Stock collapse. Criminal referrals.

Tencent: nothing. Market cap $400B+. WeChat: 1.3 billion users. Listed on HKEX. Traded freely. Spamhaus report published, acknowledged, unchanged. The infrastructure persists because the system that would punish it is the system that uses it.

XV. Cross-Reference: Existing Investigations

XVI. The Human Cost: Children, Organs, and the State That Watches

This is not a technical infrastructure report. This is about what the infrastructure does.

The one-child policy (1980-2015) created the market: demographic pressure, gender imbalance (30 million "missing" women), demand for boys. The trafficking infrastructure filled that demand. WeChat — Tencent's platform, 1.3 billion users — has been documented as a trafficking coordination tool: recruitment via job ads, transport coordination, payment. The platform removes political dissent within minutes. Trafficking content persists.

Mandiant APT1 (2013): PLA Unit 61398 — military hackers running at least 937 command-and-control servers on 849 IP addresses in 13 countries, routed through compromised "hop point" systems (corrected 2026-09-26). The same state runs military espionage, compels corporate cooperation, harvests organs, and loses track of 178 infants. The infrastructure is one system. It serves power, not protection.

XVII. Sources and Methodology