TI-2026-065A — The Second Front

Series: The Return · Part A · Classification: CRITICAL · Confidence: HIGH

For a year we described Tencent/Aceville with a confidence that was, in one specific sense, unearned. Not because the evidence was wrong — it was right — but because it came from a single eye. We watched AS132203 through the SSH honeypot and the RDAP record, and we wrote The Wrapper (031A), The Aceville Shell (045D), The Tencent Cash Machine (042I) from that one vantage. We never said what we could not see. This part is about what we could not see.

Executive Summary

Aceville Pte Ltd — the Singapore incident-response shell that fronts Tencent Cloud's AS132203 — has a second attack front on the web (HTTP/L7) layer that no prior dossier documented, for the simple reason that the sensor did not exist when those dossiers were written.

It exists now. The web-threats platform — our third observation point, built on Traefik access logs, CrowdSec L7 decisions and MikroTik L3 bans — independently, without being told to look for Tencent, fingerprints an AS132203 web cohort:

• 203 web IPs, effective_bad_rate = 0.435 — i.e. 43.5% of the traffic is hostile once the login-page 200-mask is stripped away
• A dedicated classification category the platform coined on its own: tencent-aceville — 112 IPs, 516 HTTP requests
• A dominant web tactic that is not media delivery but .env and .git secret-file harvesting
• Live CrowdSec and MikroTik bans running through today, not a historical trace

The SSH picture was true. It was also, we now know, an undercount by an entire protocol.

I. The Forensic Reconstruction — What the Web Sensor Literally Shows

The web-threats platform assessed AS132203 (last computed 2026-07-08) as follows:

Two numbers in that table carry the whole finding. The raw 404-rate is a sleepy 0.138 — a status-code-based tool would glance at AS132203, see mostly 200s and a few 404s, and file it as background noise. The effective bad-rate is 0.435 — because a large slice of the "200" responses are the Authelia login SPA handed to a scanner probing a path it should never have asked for. (This is the web-layer methodology: an HTTP status code is a costume, not a verdict. We score after the mask is pierced.)

The signature probe: 43.134.219.52

One IP makes the tactic concrete. 43.134.219.52 — AS132203, RDAP org IRT-ACEVILLEPTELTD-SG, "operates" Tencent Global, RDAP country HK — issued this in a single burst at ~65 paths/hour behind a spoofed Windows browser user-agent:

GET /.env.backup      → 404
GET /.env.bak         → 404
GET /.env.dev         → 404
GET /.env.development  → 404
GET /.env.old         → 404
GET /.env.prod        → 404
GET /.env.production   → 404
GET /.env.save        → 404
GET /.env.staging     → 404
GET /.env.swp         → 404

Ten variants of one filename. This is not a browser and it is not a CDN serving QQ or WeChat. It is an automated harvester hunting for a developer's leaked .env — the file that, when it slips into a public web root, contains database passwords, cloud API keys, payment-processor secrets and signing keys. CrowdSec tagged it precisely: watchdog-http-probing (12 paths) and then web-threats/autoban: credential_harvest:12.

It is happening now

This is not archaeology. As of 2026-07-08, CrowdSec holds active multi-day bans on 43.128.81.242 and 43.135.172.89 for http:scan, and on 43.134.219.52 (auto-banned for credential_harvest:12, mirrored to the MikroTik crowdsec-blacklist, last seen 2026-07-08 20:45). Daily web hits from AS132203 ran unbroken 15–42 requests/day from 12–25 distinct IPs across the first week of July.

II. The Seven Questions

Who is this? AS132203 — registered to Shenzhen Tencent Computer Systems Company Limited (APNIC, allocated 2012), operated as Tencent Global, and administratively fronted for abuse handling by Aceville Pte Ltd in Singapore via the RDAP incident-response handle IRT-ACEVILLEPTELTD-SG. The identity is not in dispute; only the surface has grown.

Why did it attack? To harvest secrets. The web intent is credential_harvest — .env/.git sweeps for leaked credentials and keys — with a supporting cast of cms_detect, shell_upload and api_enum. The goal is the same one the SSH botnet pursued from the other side: acquire access.

Who does it claim to be? In PeeringDB, a "Content" network — info_type=Content, policy Open, www.tencent.com, aka "QQ/Wechat". Content networks peer openly because they serve media. The costume says CDN.

Who is it really? A network whose observed web behaviour is a mass secret-harvesting operation running at 43.5% effective-bad-rate — the opposite of content delivery. The costume and the conduct do not match.

Whom is it related to? Itself, on the other sensor. The same_asn_web_and_ssh crosslink (HIGH) and the actor_cluster_001 tag bind this web cohort to the SSH botnet documented across the 025/031/037/042/045 series. The full cross-layer resolution is Part B.

Where is the money? In the cloud rent. These are Tencent Cloud CVM/Lighthouse instances — disposable, hourly-billed VMs. The attacker's cost is a credit card and an API call; Tencent's revenue is the instance-hour. Every .env sweep in this dossier was, to Tencent, a paying customer workload.

What is the official anchor? APNIC (RIR), PeeringDB (self-classification), and the Aceville Pte Ltd RDAP registration — a Singapore company whose only documented function in the record is to handle abuse for this space (that is what an IRT handle is). The abuse contact exists. The abuse continues.

III. What If — The Alternatives the Surface Rules Out Too Fast

• What if this is a handful of compromised customer boxes, not a pattern? Then we would expect a few noisy IPs and a long benign tail. Instead we see 203 IPs, a coherent .env-sweep TTP repeated across the cohort, and a platform confident enough to mint a tencent-aceville category. Breadth defeats the "few bad tenants" reading.
• What if the 200s really are benign? They are not 200s. They are effective_status 401/404 wearing a 200 costume from the Authelia login SPA. The mask is the trap; piercing it is the method.
• What if this is just internet-wide scanning that happens to include us? Partly true — and important. See the counter-narrative below.

IV. Steelman — The Strongest Innocent Explanation

Build the best case for the defence: Tencent Cloud is a hyperscaler with millions of tenants. A fraction will always be compromised or malicious. The .env sweeps are generic, internet-wide scanning; our honeypot is one of a billion targets. Tencent even funds an IRT to handle exactly this. Singling them out is selection bias — every large cloud looks like this.

This is a serious argument, and part of it holds: the .env/.git TTP is generic, and much of this traffic is broad scanning, not a manhunt aimed at us. We concede that fully — and it is why the next part in this series is titled The Persistence, not "The Retaliation." We will not claim targeting we cannot prove.

But the steelman fails on three sourced points:

1. The double standard is the story. Apply the identical instrument to the identical behaviour and name it regardless of the brand — that is the editorial rule (see 032H). AWS, Azure, Google and DigitalOcean also show up in our web data and we name them too (046E, 059B). Tencent gets no discount for being a $450B company; it also gets no surcharge. The tencent-aceville category was cut by the same knife as everyone else.
2. The IRT is the tell, not the defence. A network that funds a dedicated abuse-response entity (Aceville / IRT-ACEVILLEPTELTD-SG) and still emits credential-harvest at 43.5% effective-bad-rate for months is not failing to notice. The abuse desk exists; the abuse persists beside it. That is a policy choice, not an oversight.
3. The "Content" label. A hyperscaler with a compromised-tenant problem does not classify the space as Content. The self-description is a peering convenience that also happens to lower scrutiny — a small, quiet act of reputation management explored in Part G, The Content Mask.

The attribution that survives its own best counter-argument is the narrow one, and we state exactly that: AS132203 originates a sustained, live web credential-harvesting surface; whether any given probe is aimed at us specifically is not claimed here.

V. Read Between the Lines

• A Content CDN does not enumerate /.env.staging and /.env.swp. The gap between the PeeringDB self-portrait and the packet capture is the loudest thing in the record.
• The RDAP org is literally an incident-response team — the entity whose job title is "we handle the abuse." The record contains the fix and the problem in the same field.
• The web sensor found Tencent without being asked to. No analyst seeded a Tencent watchlist; the pipeline clustered the behaviour and only afterward did the name attach. Behaviour-first attribution is harder to accuse of bias.

VI. The Institutional Anchor & The Money

Nothing here operates outside official structures. The IP space is APNIC-delegated. The peering posture is PeeringDB-declared. The abuse contact is a registered Singapore corporate entity, Aceville Pte Ltd, sitting inside Tencent's consolidated corporate chain (documented in 031A / 042I). The business model that makes it all frictionless is IaaS billing: an attacker rents a CVM by the hour, runs a secret-harvest sweep, and is a line item on Tencent Cloud revenue whether the sweep succeeds or not. The financial incentive to look away is structural, not personal.

VII. The Human Layer

Somewhere a small team shipped a web app and left a .env.backup in the web root — a Friday mistake, the kind everyone makes once. On the other end of 43.134.219.52's ten-variant sweep is that team's Stripe key, their database password, their cloud token. The harvest is cheap, industrial and indifferent; the cost lands entirely on whoever left the door ajar. The numbers in Section I are the proof. This paragraph is the reason it matters.

VIII. Verdict

AS132203 (Tencent Global / Aceville Pte Ltd) operates a live, sustained web-layer credential-harvesting surface — 203 IPs, 43.5% effective-bad-rate, .env/.git sweeps, actively banned through today — that a full year of SSH-only dossiers could not see and therefore never reported. Confidence: HIGH for the existence, scale and liveness of the web front (direct sensor + CrowdSec/MikroTik corroboration). Confidence deliberately not asserted for targeting-of-us — that is the honest boundary, and the seed of Part B and Part C.

IX. Defensive Response

Already automated and live: CrowdSec http:scan and web-threats/autoban: credential_harvest scenarios ban offending AS132203 IPs on detection; bans propagate to the MikroTik crowdsec-blacklist at L3. No manual action was required for this dossier — the defence wrote its own timestamps.

Crosslinks

• TI-2026-031A — The Wrapper — the SSH/RDAP foundation: one NIC handle, 181 IPs, ten claimed countries, one Singapore route.
• TI-2026-045D — The Aceville Shell — how the shell distributes reputational cost.
• TI-2026-042I — The Tencent Cash Machine — the state-adjacent infrastructure argument.
• → TI-2026-065B — One Operator, Two Doors — the cross-layer resolution: proving the web cohort and the SSH botnet are one operator.

Sources: web-threats platform (Traefik/CrowdSec/MikroTik), honeypot entity-resolution crosslinks, PeeringDB, APNIC RDAP. All figures reproducible from the SOC API. TLP:WHITE.