LSN โ€” Local Sovereign Network

The Chinese Ecosystem, Part Q โ€” Southbase: A New Guangzhou IDC Node Runs C2

TI-2026-045Q ยท The Chinese Ecosystem, Part Q Confidence: HIGH โ€” a focused, incremental addition: the ASN and its C2 classification are new; the thesis is the established 045E/059D finding, reinforced Classification: TLP:WHITE

What this is, and what it isn't

Most parts of this corpus argue a new thesis. This one does not, and it is more useful to say so at the top than to dress it up. The Chinese Ecosystem already made its central case โ€” in Part E, "The State Telecom That Attacks" (TI-2026-045E), in Scanners in the Mirror (059D), and in Glass Houses Revisited (042I): that China Telecom's Internet Data Centers are not accidental sources of abuse but deliberate, billed, MIIT-compliant service environments from which sustained hostile traffic is permitted to originate. In China, the series observed, the line between "telecom" and "state attacker" is not one that exists.

This note adds a single new node to that documented map. It is short by design. Its value is completeness and a fresh data point โ€” a China Telecom IDC ASN the corpus had not yet recorded, caught running servers the classifier calls botnet C2 โ€” not a reframing of anything. Stated plainly so the record stays honest about the difference between new and confirmed.

A word on method, because it is the reason this note exists in this form: a naive check for the ASN number alone would have called it "novel" and invited a full flagship dossier. The semantic search across the corpus said otherwise โ€” it immediately surfaced 045E, 059D and 042I as the covering thesis. That is what kept this an addition rather than a re-announcement of a known pattern.

The new node: AS135089, Guangzhou-Southbase

The subject is AS135089, holder CHINANET-Guangzhou-Southbase-IDC โ€” China Telecom. It is APNIC-allocated (2022-06-22), announces 134 IPv4 prefixes plus IPv6, and entity-resolution classes it cleanly as hosting, verdict consistent. It is exactly what its name says: a China Telecom Internet Data Center in Guangzhou.

It is also, unmistakably, a node of the cluster this series already documented. One of its member IPs โ€” 14.116.254.43 โ€” is cross-attributed by OSINT sources to both AS135089 and AS58466 (CT-Guangzhou-IDC), and AS58466 is already on record in Scanners in the Mirror (059D). That same IP carries the tag actor_cluster_001 โ€” the estate's largest honeypot actor cluster. So Southbase is not a stranger; it is another door in the same Guangzhou IDC building the series has been walking through, alongside the previously-catalogued AS4812, AS134238, AS140527, AS134756 and AS58466.

What it did: C2-classified servers on a scanner fingerprint

Nine AS135089 IPs reached the SSH honeypot across late May to early July โ€” 57 login attempts, one success. Two of them matter:

The deep-enrichment classifier labels both botnet / c2_infrastructure at threat 100. That classification is the point. As Part E argued, an IDC server is not a hijacked doorbell or a compromised home router โ€” it is rented, provisioned, powered, monitored, and billed. When it is classified as command-and-control infrastructure, the relevant question is not "who infected it" but the service-ecology question the series has always asked: who is allowed to rent this, remain online, and keep generating this traffic?

Their SSH client fingerprints round out the picture. The dominant HASSH (03a80b21afa810682a776a7d42e5e6fb) resolves to libssh_0.11.x, classified scanner โ€” and it places these IDC servers inside a honeypot campaign of 1,313 IPs across 84 countries running that same commodity library. A go_scanner fingerprint and an OpenSSH_8.x appear alongside. The IDC's servers run the same off-the-shelf scanning tooling as the global fleet; the only thing distinctive about them is the trusted state-carrier address space they run it from.

The abuse desk that exists but doesn't matter

There is one detail worth drawing out because it distinguishes this from the offshore hosts elsewhere in the wider corpus. AS135089's RDAP abuse contacts are real: anti-spam@chinatelecom.cn, abuse_gdicnoc@163.com, antispam_zjnoc@163.com, with genuine +86 phone numbers for the Guangdong and Zhejiang network operations centres. Unlike a Seychelles privacy-fronted decoy, there is a named state carrier at the other end.

And yet, per this series' established finding, that changes little. The Chinese Ecosystem documented that MIIT-compliant carriers treat IDC-originated abuse as a matter of permitted service, not of oversight to be corrected on complaint. The abuse desk is reachable; the traffic persists anyway. That is not a contradiction โ€” it is the thesis. The address space is trusted, the contact is real, and the C2-classified servers keep running, because in this ecosystem the carrier and the state are the same body and the IDC is a sanctioned environment. Southbase is one more instance of exactly that.

The honest ledger

No individual is named; the state carrier is the institutional anchor, characterised exactly as the prior parts characterised it. This is a data point in a documented pattern, published for completeness. Sometimes the right dossier is a short one.

Cross-references

This dossier is an incremental addition to The Chinese Ecosystem, documenting a newly-observed China Telecom IDC ASN (AS135089) and its botnet-C2-classified servers, for defensive purposes. The thesis is the established finding of the referenced prior parts; novelty is limited to the specific ASN and classification, and is framed as such. China Telecom is the institutional anchor; no individual is named. TLP:WHITE.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Chinese Ecosystem โ€” 17 / 17 Next โ†’