The Chinese Ecosystem Part I — The Credential Factories: AS4837, AS9808, and Industrial-Scale SSH Harvesting

HONEYPOT EVIDENCE

Over eighteen months of continuous honeypot monitoring, one pattern kept returning with a persistence that stopped looking accidental and started looking structural. The infrastructure that touched the Romanian sensors was not limited to Chinese cloud providers, not limited to obviously rented VPS space, and not limited to the headline names that already dominate public reporting. A substantial share of the pressure came from the consumer and enterprise access networks that sit underneath the cloud story: the state telecoms and their residential edges, the fixed-line and mobile environments that convert millions of ordinary devices into credential acquisition machinery.

This article isolates two of those layers. AS4837, China Unicom, produced 67 distinct IPs in the dataset with an average abuse rate of 76%. AS9808, China Mobile, produced 23 distinct IPs with an average abuse rate of 94%. These are not fringe providers. They are part of the national communications substrate. One operates at backbone and provincial scale; the other sits inside the mobile monopoly that touches massive subscriber populations, machine-to-machine links, consumer broadband, and unmanaged edge equipment. When these address spaces show up in SSH brute-force activity, the analytic question is no longer merely who rented a VM. The question becomes what kind of ecosystem keeps converting ordinary access infrastructure into industrial input for credential harvesting.

1. The dataset and the scaling problem

The complete Chinese cohort in this investigation contains 710 IPs across 84 distinct ASNs. Of those, 117 IPs carry an abuse_score=100, or 16.5% of the entire cohort. The average threat score across the Chinese sample is 11. The highest-volume Chinese sources are dominated by the familiar names from state telecom and national internet backbones: AS4811 ChinaNet Shanghai with 146 IPs at 99% average abuse, AS4134 ChinaNet Backbone with 115 IPs at 90%, then AS38365 Baidu with 79 IPs at 100%, AS4837 China Unicom with 67 IPs at 76%, and AS137718 ByteDance / Volcano Engine with 54 IPs at 100%.

Those large providers matter because they show concentration. The top five ASNs alone account for 461 of 710 Chinese IPs, or roughly 64.9% of the entire cohort. But concentration does not explain mechanism. A cloud ASN with a high abuse ratio suggests rented infrastructure, automation, maybe prepositioned nodes, maybe permissive provisioning. A residential or mobile ASN suggests something else: infected routers, exposed cameras, micro-CPE devices, low-cost Linux boards, DVRs, GPON hardware, NAS appliances, and human subscribers who never know their connection has been enrolled into a credential pipeline.

This distinction matters because the public IPs visible to a honeypot are the outer shell of the system. Behind a data-center VPS, the mapping between one public IP and one host is often operationally meaningful. Behind a consumer or mobile access network, it usually is not. One observed public IP can front a small office NAT with one infected recorder, or a carrier-grade NAT block compressing hundreds or thousands of subscribers, or a broadband aggregation point recycling sessions across time. The observed address is a clue about egress jurisdiction and cleanup responsibility. It is not a one-to-one count of infected machines.

2. Why call them credential factories?

The phrase is deliberate. Many botnets are destructive, noisy, or opportunistic. The traffic in this cohort points to something more economically coherent: persistent SSH login attempts directed at exposed infrastructure, repeated username and password combinations, and behavior consistent with the collection of valid credentials as a tradable resource. The point of a large distributed brute-force operation is not only to break one machine. The point is to create a flow: attempt, validate, store, sort, enrich, resell, reuse.

In operational terms, the chain is simple. A large bot population performs distributed credential guessing against SSH services. Each bot contributes a small amount of pressure from an IP that is difficult to blacklist without false positives because it sits inside consumer connectivity. Successful combinations are harvested into a database. The database is filtered by country, service type, banner, uptime, root access, shell quality, monetization value, and whether the host is suitable for proxying, staging, scanning, data theft, or ransomware follow-on. The resulting inventory can be used directly by the botnet operators or sold to downstream buyers in credential markets.

Seen from the defender’s side, this is what creates the feeling of endless, low-cost aggression. The source IPs are disposable. The volumes are sustainable. The recovery cost is externalized to the victim. The intelligence value of each successful login is cumulative. What the telecom provides is not necessarily intent at the individual packet level. What it provides is an environment where compromised edge devices can remain online long enough to be economically useful. That is what makes the network a factory. It continuously produces authenticated access opportunities out of unmanaged or unremediated infection.

3. AS4837 — China Unicom and the fixed-line substrate

AS4837 contributed 67 IPs, representing roughly 9.4% of the full Chinese cohort. Its average abuse level of 76% is lower than the most extreme cloud or backbone clusters, but that lower percentage is analytically important, not exculpatory. A consumer-access network that still delivers a three-quarters abuse ratio across observed hostile IPs is not showing random background internet noise. It is showing a persistent contaminated edge.

China Unicom occupies an awkward middle position in this series. It is large enough to be part of the national architecture, but the observed behavior is less cleanly interpretable as directed cloud use than what appears in Baidu, ByteDance, or some ChinaNet ranges. In AS4837 the evidence points toward a mixed ecology: some traffic looks compatible with enterprise or provincial infrastructure, some with conventional access-network compromise, some with the blurred space where carrier-owned equipment, small business routers, and subscriber devices become indistinguishable from one another in public telemetry.

The distinction between backbone and provincial behavior matters. A national carrier ASN can encompass radically different operational realities: metropolitan aggregation, enterprise access, reseller segments, regional broadband, legacy customer pools, and infrastructure inherited across years of restructuring. When abuse clusters in a backbone-facing environment, the hypothesis space includes administrative intent, tolerated scanning, or institutional blindness at scale. When abuse clusters in the residential edge, the hypothesis space shifts toward IoT exploitation, credential stuffing infrastructure, and enormous cleanup debt. AS4837 matters because it sits near that seam.

It is therefore misleading to ask whether AS4837 is “state-directed” or “merely botnet-driven” as though the two categories were mutually exclusive. The stronger conclusion is structural: a state telecom environment that can host large amounts of unmanaged abuse, and that has the technical capability to reduce it, is already part of the attack architecture even when the immediate packet generation comes from compromised consumer hardware. The infection may be botnet-driven. The persistence is infrastructural.

3.1 Backbone signal versus residential signal

Earlier parts of this series treated ChinaNet backbone ranges as a separate phenomenon. AS4134 produced 115 IPs at 90% average abuse. AS4811 produced 146 IPs at 99%. Those figures feel administratively tidy: fewer ambiguities, stronger concentration, and abuse ratios so high that they pull the analysis toward direct infrastructure tolerance or state-adjacent usage. By contrast, AS4837’s 76% looks dirtier. That dirt is the clue. It is the statistical texture of a contaminated access network rather than the crystalline concentration of a cloud block or a tightly managed backbone segment.

That difference does not weaken the threat. It changes the threat model. In backbone-centric cases, the problem is access to state-scale routing and national carriers. In access-network cases, the problem is endless replenishment. A residential edge can heal slower than a cloud node can be abused. It can also be repopulated faster. New cameras come online. Default credentials persist. ISP-supplied gateways age out but remain vulnerable. Small businesses expose recorders to the public internet because vendors told them to. The infection base renews itself without any central planner needing to touch each device.

4. AS9808 — China Mobile and the mobile attack platform

If AS4837 is analytically mixed, AS9808 is alarming for another reason: it is smaller in observed count yet higher in malicious density. 23 IPs at 94% average abuse suggests a cohort in which most observed sources were already deeply contaminated. China Mobile is not a niche ISP. It is one of the largest telecom environments on earth. When even a narrow slice of that ecosystem appears in SSH brute-force telemetry with a 94% abuse profile, the correct inference is not “only 23 IPs.” The correct inference is that public telemetry has touched only a thin outer boundary of a much larger access platform.

Mobile telecom as attack surface has several properties defenders underestimate. First, subscriber identity is fluid at the public-IP layer. Sessions move. NAT pools rotate. Egress can be shared across unrelated devices. Second, the device universe is broader than phones. Mobile networks carry cameras, GPS trackers, industrial modules, kiosks, payment terminals, low-cost gateways, hotspots, and embedded Linux systems that vendors abandon as soon as they ship. Third, remediation is socially weak. The owner of an infected module often does not know it exists as an internet-exposed computer. The carrier may detect anomalies but still choose not to interrupt paying service or to invest in mass quarantine processes.

This is what makes mobile infrastructure attractive to brute-force operators. It offers scale, address churn, heterogeneity, and plausible deniability. A single bot process can be hidden inside noisy subscriber behavior. A login burst may vanish before a complaint reaches the right abuse queue. If carrier-grade NAT is involved, the mapping between alert and device may require logs the outside world will never receive. From the viewpoint of a credential broker, these are excellent conditions. Attribution is degraded. Takedown is slow. Replacement nodes are plentiful.

5. Why residential and enterprise access networks breed botnets

Residential networks are not morally different from clouds. They are operationally softer. The modern IoT supply chain floods consumer and small-business networks with devices that are computationally capable, permanently online, remotely manageable, and frequently abandoned. Cheap routers expose web panels and outdated kernels. DVRs and NVRs ship with default credentials and undocumented services. Hikvision cameras, TP-Link routers, GPON devices, white-label CCTV systems, and budget NAS appliances all recur across public exploit reporting because they share the same ingredients: broad deployment, weak patch discipline, brittle vendor ecosystems, and owners who rarely treat them as security-critical computers.

Mirai established the model, but the model has diversified far beyond the original malware family. The important point is not the brand of malware. It is the economic geometry. Attackers do not need sophisticated implants when a weak Telnet or SSH credential works, when a recycled device password exists across thousands of units, or when an exposed management service can be brute-forced by a lightweight bot. Once a device is inside the botnet, its role does not need to be glamorous. It can run a scanner, a brute-force loop, a credential relay, or a proxy. The device becomes useful because its network position is ordinary.

That ordinariness is strategic. Cloud IPs are already high-suspicion. Residential IPs still inherit a residue of innocence in many detection systems. Some defenders are slower to blacklist them. Some abuse desks treat them as compromised subscribers rather than infrastructure problems. Some SIEM rules de-prioritize them because they resemble background internet traffic. Credential-harvesting operations exploit exactly that gray zone. Their output is not only successful logins. Their output is detection fatigue.

5.1 The NAT problem: one IP is not one host

Carrier-grade NAT turns external counting into a lower bound. One observed public IP in a mobile or residential pool can represent a single infected router, a family of subscribers sharing an egress point, a block of machine-to-machine modules, or a rolling sequence of unrelated endpoints over time. Honeypot telemetry can usually establish hostile activity. It cannot see the full population behind the translation layer. This means any interpretation based solely on public source count is conservative by construction.

This is why the phrase “67 IPs from one backbone” should not be read literally. In a residential-attack context, it is better understood as 67 externally visible egress points sampled from a subscriber ecology measured in the millions. The underlying infected device count might be one order of magnitude higher, two orders higher, or simply unknowable from outside. But it is almost certainly not equal to 67.

6. The credential harvesting pipeline

SSH brute forcing is often described as noise because defenders see it constantly. That description is true only from the victim’s point of view. From the attacker’s point of view, it is a supply chain. The first stage is target discovery: internet-wide scanning, banner collection, identification of exposed management services, and selection of brute-force candidates. The second stage is credential attack: common username dictionaries, password reuse lists, device-default combinations, weak key material, and recycled admin patterns. The third stage is validation and enrichment: once a login succeeds, the machine is fingerprinted, privilege level assessed, and monetization value estimated.

The fourth stage is where the factory becomes visible. Valid credentials are stored, ranked, deduplicated, and attached to metadata: geography, service banners, shell type, install history, host role, and downstream utility. Some will be used for immediate resale. Some will be converted into long-lived proxies. Some will become lateral-movement stepping stones. Some will be returned to the brute-force infrastructure itself as staging boxes for the next scan wave. At every step, the value lies in volume. Ten thousand failed attempts are not waste; they are the cost structure that makes one hundred successful authentications predictable.

What AS4837 and AS9808 provide to this pipeline is not necessarily command-and-control sophistication. They provide scalable, replaceable worker nodes. Infected edge devices do not need strong bandwidth or persistent storage. They need to stay online, accept instructions, and emit low-grade authentication traffic without triggering immediate takedown. The residential and mobile edge is well suited to exactly that function.

7. Attack timing: office rhythms versus machine rhythms

One of the useful distinctions in long-duration telemetry is temporal texture. Human-run operations often leave traces of work cycles: bursts around local business hours, slower weekends, or administrative clustering tied to operational routines. Botnets built from unmanaged IoT devices tend to feel different. They continue through nights, weekends, and public holidays. They do not become more polite because a workday ended. They grind.

The AS4837 and AS9808 cohorts belong more naturally to the second category. Their value is persistence, not elegance. Even when downstream operators supervise campaigns manually, the infrastructure itself is available continuously. This is one reason residential-source brute forcing feels relentless. It can maintain pressure at a low rate across long periods, blending into global background traffic while still accumulating credential hits. By contrast, some backbone or cloud-centric Chinese sources elsewhere in the series exhibit a different flavor: denser malicious concentration, tighter clustering, and patterns more compatible with curated infrastructure usage rather than unmanaged subscriber compromise.

The distinction should not be overstated into certainty. Without publishing full hourly histograms, no honest analyst should pretend to extract exact operational shifts from these two ASNs alone. But the analytic model remains strong: backbone-dominant ranges raise the question of directed or tolerated infrastructure use; residential and mobile ranges raise the question of giant bot populations whose activity is functionally 24/7. In both cases, the defender experiences continuous pressure. The difference is in what kind of institution could interrupt it.

8. The cleaning question

This is where technical analysis becomes political economy. China’s state telecom monopolies are not powerless victims of a hostile internet. They operate vast networks, control customer edges, enforce provisioning standards, run abuse and security teams, and possess the internal visibility needed to detect recurring malicious behavior. They have the engineering capability to do more than forward traffic and wait for complaints. They can deploy egress filtering policies, subscriber quarantine workflows, rate limiting, abuse correlation, sinkholing, walled gardens for infected customers, forced firmware upgrade programs, and vendor pressure at procurement scale. They can make different tradeoffs.

BCP38 is not a magic answer to SSH brute force, but the broader point stands. Networks this large can shape traffic hygiene. They can identify impossible login fan-out, repeated scanning patterns, bot-like connection profiles, and known infected CPE signatures. They can require better defaults from supplied hardware. They can act against repeat-abuse regions. If they do not, the result is not mere absence. It is a positive condition in which large-scale credential harvesting remains economically viable.

9. ChinaNet versus residential telecoms

The Chinese ecosystem becomes easier to understand when the major sources are separated by operational role. ChinaNet backbone and Shanghai segments show extreme density. Big-tech cloud environments such as Baidu, ByteDance, Tencent, Alibaba, and Huawei Cloud show another pattern: commercially branded infrastructure with abuse levels that frequently approach certainty. Residential and mobile telecoms such as China Unicom and China Mobile show a third pattern: lower administrative neatness, heavy contamination, and scaling properties that turn every public-IP count into a probable underestimate.

This comparison is not about absolution. It is about mechanism. If a defender blocks a Baidu or ByteDance node, a renter can provision another. If a defender blocks a China Mobile or China Unicom address, they may only be blocking the visible edge of a bot population that will reappear elsewhere in the same access environment. Clouds are replaceable infrastructure. Residential botnets are replenishable infrastructure. Backbone abuse is strategically concerning because of what it implies about state-scale visibility. Residential abuse is strategically concerning because of what it implies about infection depth and remediation refusal. The ecosystem uses all three.

10. What the Romanian honeypot actually sees

A honeypot in Romania is a small aperture looking into a large machine. It does not know every infected router in China. It does not claim to. What it sees are repeated contacts from publicly routable Chinese sources attempting to authenticate, repeatedly enough and maliciously enough to be categorized, scored, and compared. From that limited but continuous vantage point, two facts become difficult to escape.

First, the access-network layer is not peripheral to the Chinese ecosystem. It is an active contributor. Second, the public source count materially understates the probable size of the underlying compromised population when NAT, mobile churn, and unmanaged IoT are involved. The telemetry is therefore a compressed projection of a larger reality. Seventy-six percent abuse in AS4837 and ninety-four percent in AS9808 are not signs of isolated contamination. They are signs of an environment that keeps generating usable attacker nodes faster than it cleans them.

That is why the term credential factory fits better than botnet. A botnet describes control. A factory describes throughput. The access networks described here produce throughput: brute-force attempts, validated credentials, and a durable stream of low-trust authentication events that can be folded back into criminal or state-adjacent operations. The machines at the edge may be cheap. The economic output is not.

10.1 Enterprise spillover and the small-business edge

Residential botnet analysis becomes incomplete if it ignores the small-business layer that sits between consumer broadband and formal enterprise infrastructure. Many credential-harvesting nodes are likely to originate here: family companies, warehouses, shops, apartment buildings, clinics, workshops, parking systems, and branch offices running a mix of ISP-provided gateways, bargain routers, network recorders, IP cameras, attendance terminals, and remote-management boxes. These environments are too operationally important to be fully consumer, too under-resourced to be professionally managed, and too exposed to be safe by default.

That layer is ideal for attackers. Device lifecycles are long, replacement is deferred, integrators disappear, passwords get written on tape or copied across sites, and a single public connection often supports multiple roles at once: CCTV, payroll access, point-of-sale backup, router administration, and remote vendor support. When one component is compromised, the public-IP surface begins to emit traffic that looks like ordinary access-network abuse even though the underlying device may belong to a business context with more bandwidth, more uptime, and fewer interruptions than a normal household router. In other words, AS4837 and AS9808 do not merely represent living-room infections. They likely also represent the industrialized neglect of the lower enterprise tier.

This matters because the downstream utility of stolen credentials rises sharply when the attacking node itself comes from semi-stable small-business infrastructure. Such nodes are less likely to vanish after a family reboots a modem. They can scan steadily, hold state longer, and sometimes support lateral tasks such as log storage, lightweight proxying, or secondary brute-force orchestration. They remain cheap like residential bots yet operationally useful like low-end servers. That hybrid character is part of what makes access-network abuse so durable.

It also complicates cleanup narratives. A telecom can tell itself the problem belongs to the customer. The customer can tell itself the problem belongs to the integrator. The integrator may no longer exist or may insist the issue belongs to the telecom-provided gateway. Meanwhile the traffic continues. The credential factory does not require explicit collusion from these actors. It only requires that responsibility diffuse faster than infection is remediated.

10.2 Why simple blocking rarely solves it

Defenders naturally respond to SSH brute force with network blocks, reputation feeds, tarpits, geofencing, rate limits, and fail2ban-style controls. These are necessary. They are also strategically insufficient when the source environment is a large residential or mobile ecosystem. A cloud block can sometimes burn an individual renter. A residential block mostly burns a moment in time. The next scan will arrive from a different public IP, a different subscriber segment, or the same CGNAT pool after session turnover. The defender has reduced immediate pressure while the production system behind the pressure remains intact.

This is where access-network credential harvesting differs from boutique intrusion operations. The attacker does not need a pristine infrastructure set. They need a renewable one. The renewal comes from device churn, weak passwords, unmanaged firmware, and the ordinary inertia of telecom-scale subscriber ecosystems. Every time defenders focus exclusively on the single source IP, the ecosystem wins by forcing analysis down to the least durable artifact in the chain.

That does not make blocking useless. It means blocking must be understood as local symptom management, not a theory of causation. The causation sits upstream: in device insecurity, in telecom incentives, in the absence of meaningful external leverage, and in the economics of credential resale. This is why the access-network layer belongs in the broader Chinese ecosystem map. It is not only another source of hostile traffic. It is the layer that keeps the rest of the architecture replenished when more visible nodes are removed.

11. Final assessment

AS4837 and AS9808 are not footnotes to the Chinese cloud story. They are what makes the broader architecture resilient. When cloud nodes are burned, the residential and mobile edge keeps working. When direct attribution is hard, CGNAT and subscriber churn make it harder. When defenders look only at famous cloud brands, the bot population in ordinary telecom space continues harvesting credentials one password at a time. The ecosystem does not depend on a single mode of operation. It combines administratively visible infrastructure with socially invisible compromise.

The strategic conclusion is therefore narrower and stronger than rhetoric. Chinese residential and enterprise access networks function as credential factories when large compromised device populations are allowed to remain online inside monopoly telecom environments that possess the capacity, but apparently not the will, to clean them at scale. The 67 China Unicom IPs and 23 China Mobile IPs observed in this dataset are not a census. They are the visible outlets of a larger production system.

Later in the series, these access-layer findings are reassembled with the state telecom, cloud, offshore-wrapper, and legal-architecture parts. The picture that emerges is not a one-off brute-force nuisance. It is a durable system in which residential compromise supplies the labor, telecoms supply the environment, and the higher layers consume the output.

12. Read the incentives, not just the packets

The decisive question is not whether one can narrate a dramatic command chain from a ministry office to a compromised DVR in a provincial access network. The decisive question is what incentives allow the DVR to remain useful for months at a time. A monopoly carrier keeps the customer. A hardware vendor already booked the sale. The outside victim absorbs the authentication noise. The international researcher bears the cost of attribution. When costs and benefits are distributed that way, cleanup becomes politically optional even when it is technically feasible.

This is why the phrase “read the incentives” matters more than the phrase “prove the conspiracy.” Systems can behave strategically without every layer sharing the same conscious motive. Criminals want credentials. Brokers want inventory. Some state-adjacent actors may want a noisy credential environment they can mine or hide within. Carriers may simply want not to disrupt paying users. These motives are different, yet they converge on the same operational outcome: a huge access edge left dirty enough to keep producing login attempts and occasional successes.

For defenders, that convergence is what matters. The attack surface is not one bad actor. It is a durable arrangement in which nobody with sufficient power has enough incentive to clean aggressively. That is how a credential factory survives even when many of its individual machines are banal and unsophisticated.

13. Why foreign defenders keep paying the bill

One reason residential-source brute force remains under-theorized is that the direct pain is exported. The compromised camera sits in China. The telecom account is in China. The cleanup authority is in China. But the authentication pressure lands on exposed servers in Europe, North America, Southeast Asia, and everywhere else reachable over the public internet. The victim sees logs, lockouts, and support tickets. The provider sees, at worst, a slightly dirtier egress graph.

This export of cost is strategically important. It means the institutions best placed to reduce the harm do not experience most of the harm themselves. A Romanian honeypot or a German server admin is forced into repetitive local mitigation while the upstream ecology remains intact. Abuse becomes someone else’s nuisance. At scale, that asymmetry functions like a subsidy for the attacker side: the external world finances the defensive friction while the source environment preserves the offensive convenience.

14. What foreign defenders should do with access-network evidence

Foreign defenders cannot clean Chinese access networks themselves, but they can stop underestimating what the evidence means. CERT teams, SSH service owners, managed-service providers, and hosting companies should preserve memory around recurrent ASN patterns, tune controls for low-and-slow password pressure, and treat access-network brute force as an ecosystem indicator rather than a disposable annoyance. The goal is not to punish entire populations. It is to respond to repeated structure with repeated discipline.

They should also share more aggressively across layers. The SOC that sees brute force, the incident responder who sees credential reuse, and the policy team that studies telecom governance are often working with different slices of the same problem. Part I argues that these slices belong together. Residential-source attacks are not beneath strategy. They are one of the places strategy becomes economically possible.

Most importantly, defenders should stop accepting the fiction that continuous credential pressure is just the natural weather of the internet. Weather has no custodian. Access networks do. Once repeated hostile traffic is traced to enormous telecom ecosystems capable of meaningful remediation, the language of fate becomes the language of excuse.

Series Connection