🏢 Part II — TikTok's Parent Company Hosts the Swarm

ByteDance — the company behind TikTok, Douyin, and a portfolio of apps used by over a billion people — operates enterprise cloud services under two brands: Volcano Engine (China domestic) and BytePlus (international). Together, they host 141 scanner IPs in the libssh swarm — 6% of the entire operation.

The 90 Volcano Engine IPs are exclusively in the 0.11.x campaign — the expansion phase. Not a single one appears in 0.9.6 or 0.12.0. This burst-deployment pattern suggests the Chinese domestic cloud was used for rapid scaling and then abandoned — possibly because abuse handling improved, or because the operator moved to cheaper infrastructure.

This was previously documented in TI-2026-045K. ByteDance's cloud is not uniquely culpable — Amazon, Microsoft, Google, and DigitalOcean all host swarm nodes. But the concentration (141 IPs = more than any country except US, China, and Hong Kong) makes ByteDance infrastructure structurally significant to this operation.

🇨🇳 Part III — China's Version Skew

China contributes 228 IPs to the swarm. But the distribution across campaigns is unlike any other country:

96.5% of Chinese IPs appear only in the 0.11.x campaign. Compare this to the top-15 countries overall, where every country appears in all three campaigns. China was used for exactly one purpose: the 0.11.x expansion wave. The nodes were provisioned, used, and then discarded.

The Chinese cloud providers involved: Volcano Engine/ByteDance (90), ChinaNet/China Telecom (31), Baidu Cloud (23), China Unicom (8). The first is a commercial cloud. The last three are state-owned or state-adjacent telecoms — their IPs may represent compromised endpoints rather than provisioned scanners.

🇸🇬 Part IV — Singapore: The Optimal Launch Pad

Singapore (160 IPs, 27.1 per million) serves as the swarm's Asian hub. But the concentration is not distributed across Singapore's hosting ecosystem — it is concentrated on two providers:

Singapore's value is not jurisdictional opacity (its legal system is robust and English-speaking). Its value is network performance: excellent peering to Southeast Asia and China, multiple submarine cable landings, low latency to the largest target population (Asia-Pacific). The operator chose Singapore to scan Asian targets fast, not to hide.

📊 Part V — The Detection-Action Gap

Nearly half the swarm has been reported to maximum severity — and is still operating.

1,143 IPs have been reported to AbuseIPDB at the maximum severity — score 100 out of 100. The security industry knows these IPs are malicious. Every threat feed includes them. Every SIEM would flag them. And yet they are still scanning.

This is not a detection problem. It is an action problem. The gap between detection and action is the swarm's operating margin:

• Abuse handlers who don't respond — UCloud-HK, Volcano Engine, Cloud Innovation have no public track record of acting on abuse reports
• Jurisdictions that don't cooperate — a European CERT's abuse report about a Seychelles IP traverses two legal systems that share no mutual assistance framework
• Cloud providers who treat abuse as a cost center — taking down paying customers costs revenue; processing abuse reports costs labor; the economic incentive is to do nothing

🗺️ Part VI — The Continental Map

The all-3-campaigns presence of the top 15 countries proves geographic persistence — the operator maintains infrastructure in these locations across version upgrades. The geography is strategic, not accidental.

🔗 Related & Coming Next

Sources: Cowrie honeypot · AbuseIPDB · GreyNoise · RDAP · entity_links · TI-2026-042O · TI-2026-045K · TI-2026-028 · TI-2026-025D · Seychelles IBC registry
Investigation: TI-2026-049C · 8 evidence · 4 actors · 6 findings · 6 connections · 7 infrastructure
Confidence: HIGH — direct observation + per-capita statistical analysis + cross-dossier institutional verification
Classification: TLP:WHITE