ChinaNet AS4134: The State Telecom That Attacks

Introduction

ChinaNet AS4134 is not an obscure access network on the edge of the internet. It is China Telecom's flagship backbone: enormous, old, politically connected, operationally sophisticated, and deeply entangled with the state's conception of national power. When a network of that scale appears again and again in hostile SSH telemetry, the explanation cannot stop at the phrase abuse happens everywhere. Scale changes meaning. A small unmanaged ISP can plead incapacity. A national backbone with 111 million routed IPv4 addresses, 2,281 prefixes, and 442 peers cannot.

The central question is not whether malicious traffic can emerge from AS4134. Of course it can. The real question is why it keeps emerging from state telecom infrastructure that demonstrably has the ability to shape, filter, and suppress traffic whenever the Chinese state considers the objective important enough. That is what makes ChinaNet different from a random compromised hosting network in another jurisdiction. It is not merely powerful. It belongs to a state apparatus that has already proven it can discipline information flows at continental scale.

This matters because the broader TI-2026-045 series is not an argument about one rogue server, one misconfigured provider, or one opportunistic reseller. It is an argument about architecture. Earlier parts established that Chinese cloud and telecom infrastructure repeatedly sits underneath scanning, credential-harvesting, and exploitation activity. Part E brings the backbone into focus. When the country's largest state telecom produces both national connectivity and hostile external traffic, the boundary between commercial carriage and strategic utility becomes very thin indeed.

The evidence base here mixes direct observation with history. Our telemetry shows China Telecom group infrastructure, including AS4134 and AS4811, at concentrations that would already be alarming on their own. The public record adds something harder to dismiss: repeated BGP misrouting incidents, FCC sanctions, and a DoD determination connecting China Telecom to the PLA. Each individual datum could be rationalized. Together they describe a network with persistent offensive relevance and a state that has declined every meaningful opportunity to prove otherwise.

The scale problem: this is not noise from the margins

AS4134 advertises roughly 111 million IPv4 addresses. That is not a typo and not a statistical curiosity. It means the network exists at a level where automation, routing hygiene, abuse handling, lawful interception, traffic engineering, and policy controls are not optional competencies but prerequisites of operation. The same institution that can keep a national backbone stable across 2,281 prefixes can absolutely distinguish ordinary customer traffic from recurring SSH scanning and password attacks leaving its own estate.

There is a tendency in public cyber discourse to treat large networks as morally neutral terrain, almost like weather systems. Abuse comes in, abuse goes out, and responsibility dissolves in the complexity of peering. That framing is useful for providers who want the status of passive conduit without the burden of active stewardship. But it breaks down badly in the Chinese case. China Telecom is not merely a market actor. It is a state-owned enterprise operating inside a political system that reserves the right to direct private and public infrastructure for state purposes.

The statistics around AS4811 sharpen the point. The Shanghai segment referenced in the series sample contributes only 146 observed IPs, yet roughly 99 percent of that slice scores as abusive. That does not prove every packet was centrally tasked. It proves something narrower and sufficient: traffic emerging from these systems is not rare, not accidental in the statistical sense, and not being meaningfully suppressed. When a provider with enormous visibility tolerates that profile, permissiveness itself becomes evidence.

The correct analytic move is therefore not to ask whether a giant telecom can contain abuse perfectly. No large operator can. The correct question is whether the pattern and persistence are compatible with a good-faith remediation model. In AS4134's case, the answer is increasingly difficult to defend. The network is too large to be blind, too centralized to be helpless, and too politically integrated to claim the detached innocence common in Western telecom press releases.

What the honeypot actually saw

Direct telemetry matters because it grounds the article in something more solid than geopolitical suspicion. The series dataset captured 231 IPs from Chinese state-adjacent telecoms and 295 from the broader China Telecom group alone. Within that, AS4134 and the Shanghai-linked systems surfaced repeatedly in SSH scanning, credential attacks, and tooling clusters. The phrase group infrastructure is important. These were not only residential edge devices or clearly consumer-grade routers. Multiple indicators point to IDC and server-side environments, the sort of infrastructure from which sustained scanning is operationally convenient.

One of the clearest signs that this is more than household compromise is clustering. The observed campaign artifacts align across systems, not just as isolated login attempts but as recurring operational behavior: repeated port 22 probing, common credential lists, recognizable HASSH fingerprints, and timing patterns that line up with UTC+8 working rhythms documented elsewhere in the series. Even if every individual IP were leased to a third party, the provider still sits at the choke point with more visibility than the victim, the researcher, or the downstream abuse desk.

The HASSH cluster labeled go_scanner (23 IPs / 6 countries) illustrates the ecosystem nature of the problem. The cluster spans 23 IPs across six countries, but Chinese state and quasi-state networks form a substantial part of its operational spine. When China Telecom, China Unicom, Tencent-adjacent infrastructure, and other Chinese networks recur inside the same campaign families, the issue stops being one provider's bad luck. It becomes a supply-side pattern: a set of environments that reliably hosts, relays, or tolerates offensive traffic.

The session-level evidence also matters psychologically. Security professionals have been trained to distrust anecdote, and rightly so. But packet evidence gains force when paired with institutional asymmetry. A single target sees one attack at a time. China Telecom could see the full pattern across customers, prefixes, data centers, and time. That asymmetry is what converts telemetry into responsibility. The victim's visibility is partial. The backbone's visibility is systemic.

One should be careful not to overclaim. Telemetry does not by itself prove that every malicious packet was ordered by Beijing. But it does prove that Chinese backbone and telecom infrastructure remains a favored substrate for activity the operator could more aggressively suppress if suppression were the goal. The distinction matters. In threat intelligence, permissive infrastructure can be strategically valuable even without a signed command memo.

The BGP record: six times is not a coincidence

BGP incidents occupy an awkward space in intelligence analysis because the protocol was never designed with strong security guarantees, and route leaks do happen by mistake. Analysts who want to remain sober about evidence have to say that plainly. Yet sobriety cuts both ways. If the same operator repeatedly appears in internationally consequential misrouting events over many years, the burden of explanation shifts. Randomness is always available as a rhetorical escape hatch. At some point, however, repetition becomes its own category of evidence.

The April 2010 event is the obvious anchor. For roughly 18 minutes, about 15 percent of global internet traffic was redirected through China Telecom routes. Traffic associated with U.S. government and military destinations appeared inside the affected set. China Telecom denied malicious intent, and purely technical ambiguity remains. But ambiguity is not acquittal. Eighteen minutes is long enough to notice, long enough to matter, and short enough to resemble a controlled episode rather than a sprawling collapse. Even if one grants accident, it was an accident of extraordinary geopolitical significance.

The subsequent incidents strip away the luxury of treating 2010 as a singular anomaly. In November 2018, Google-related prefixes were implicated in another China Telecom-linked route event. In June 2019, roughly 40,000 routes from Swiss provider SafeHost propagated through China Telecom. By April 2024, the FCC's language had hardened: it cited at least six BGP misrouting occasions. That phrasing matters because regulators do not casually volunteer repeated route-manipulation history in a national-security proceeding unless they view the pattern as probative.

Routing incidents are strategically attractive because they live below the threshold of spectacle. A border crossing filled with soldiers is visible to everyone. A route advertisement is visible mainly to specialists, and even they must argue over intent. That ambiguity is the utility. A state-linked backbone can gain intelligence value, traffic visibility, testing opportunities, and signaling leverage while preserving deniability behind protocol complexity. It is the perfect medium for a system that wants effect without confession.

It is tempting to mentally separate routing incidents from SSH abuse because one feels grand-strategic and the other feels low-level. That is exactly the wrong way to see it. They are different altitude bands of the same problem. The first asks whether a provider can influence where traffic goes. The second asks whether the provider meaningfully constrains what leaves its systems. In both cases, China Telecom's history suggests ample capability, repeated controversy, and insufficient evidence of genuine self-policing.

AS4811 and the concentration problem

Part E is nominally about AS4134, but it would be analytically dishonest to isolate the backbone from its provincial and metropolitan siblings. AS4811 ChinaNet Shanghai offers exactly the kind of local concentration analysts look for when deciding whether a phenomenon is diffuse or structured. In the sample referenced by this series, the AS4811 slice is small in absolute count yet extreme in quality: about 146 IPs, and roughly 99 percent of them score as abusive. That ratio is not a natural background pattern one expects from a neutral customer mix.

The value of AS4811 is that it narrows the aperture. A giant backbone can always claim it is too broad for any localized behavior to say much about the whole. But when a tightly linked sister network shows very high abuse density, the argument becomes weaker. Now we are not just looking at one enormous entity with a few ugly corners. We are looking at multiple segments inside the same state telecom complex producing complementary signals: backbone recurrence, IDC-originated hostile activity, and metropolitan concentration.

The group-level figure—295 China Telecom IPs, or 42 percent of all Chinese IPs observed—matters for the same reason. An ecosystem analysis asks where things accumulate. If one telecom family accounts for nearly half of the Chinese slice in an investigation built from many networks, the rational hypothesis is not chance. It is preferential utility. Attackers, resellers, contractors, or state operators keep finding these environments useful enough to return.

Once concentration reaches this level, analysts have to stop treating victimization as evenly distributed. It is not. Infrastructure choices create attacker advantages. China Telecom's networks appear repeatedly because they provide some combination of scale, persistence, inadequate remediation, legal insulation, and strategic tolerance. In later parts of the series we will see how law and international governance gaps help preserve that utility. Here, the dataset already tells us the operational outcome.

Capability versus intent: what a state telecom could stop if it wished

A network like AS4134 does not need to achieve perfect detection in order to invalidate the victim's frustration. It only needs to do better than this. Modern carriers deploy flow analytics, anomaly detection, DDoS filtering, abuse intelligence, customer segmentation, sinkholing, ACLs, route communities, and manual intervention teams. They coordinate across peering relationships. They can identify brute-force bursts against port 22. They can distinguish noisy residential malware from traffic originating in leased IDC space. They can suspend customers when political or commercial pressure exists. We know this because carriers do it every day in other contexts.

China's internal internet regime makes the argument stronger, not weaker. The same system that can rapidly suppress politically inconvenient keywords, social narratives, VPN usage, and cross-border information flows cannot credibly claim total impotence against long-lived external abuse patterns. One does not need to assert omniscience. One only needs to notice the asymmetry of enforcement. Speech the state dislikes gets filtered with remarkable speed. Outbound malicious traffic from strategically useful environments seems to survive much longer.

From suspicion to sanction: what the FCC and DoD already concluded

U.S. regulators and defense officials are not omniscient, and they certainly operate with their own strategic priors. That caveat should be stated clearly. But dismissing their findings entirely would be lazy. In November 2020, the U.S. Department of Defense placed China Telecom on its list of companies linked to the People's Liberation Army. In October 2021, the FCC revoked China Telecom Americas' authorization to operate in the United States, citing national-security concerns. By March 2022, the language around risk was unmistakable.

These actions matter less as appeals to authority than as institutional signals about how much classified and unclassified concern had accumulated around China Telecom's role. Licensing revocation is not a symbolic gesture. It is an acknowledgment that the ordinary assumption of carrier neutrality no longer held in U.S. policy analysis. Part E does not need the FCC to prove every packet in our dataset. It needs the FCC to show that our findings exist inside a much larger, already recognized national-security context. They do.

The April 2024 FCC reference to at least six BGP misrouting occasions is especially important because it bridges technical history with regulatory judgment. It tells the reader that repeated routing anomalies remained alive in the institutional memory of U.S. regulators years after the headline incidents. The December 2024 Commerce crackdown and March 2025 subpoenas extend the same trajectory: concern is not receding with time. It is hardening into a cross-agency posture.

One can object that American regulators will naturally interpret Chinese infrastructure through a strategic lens. True. But strategic rivalry does not fabricate route leaks, honeypot IPs, or statutory obligations inside China. The proper method is not to accept every accusation uncritically. It is to see where independent lines of evidence overlap. In China Telecom's case, public sanctions, public routing history, and direct abuse telemetry overlap in ways that are difficult to wave away.

The compromised-camera excuse and why it no longer persuades

Whenever large-scale abuse emerges from a telecom network, the first reflex is to imagine an ocean of infected consumer gear: cameras, DVRs, SOHO routers, forgotten NAS boxes. That explanation exists because it is often true somewhere. The problem in Part E is not that such devices do not exist in China. The problem is that the evidence here does not comfortably fit a story of random household infection. The series repeatedly encounters server-side, IDC, and network-core contexts that are operationally different from compromised living-room hardware.

Why does that distinction matter so much? Because consumer compromise implies diffuse responsibility and low provider visibility. IDC-originated scanning implies the opposite. Server tenants generate repeated patterns from stable environments. They lease capacity, receive billing, attach to provisioning systems, and often operate from address space the provider can segment with relative ease. A state telecom can still claim customer misuse, but the claim no longer sounds like helplessness. It sounds like a policy choice about how much abuse is worth interrupting.

The excuse also breaks against concentration. If the dataset showed thinly scattered activity across endless residential edges, the consumer-malware narrative would remain stronger. Instead, China Telecom group systems accumulate enough density that the defensive imagination has to widen. At some point the analyst must ask whether this ecosystem is being selected precisely because it is resilient against foreign complaint and comfortable with ambiguous traffic origins.

Why IDC provenance changes the meaning of the evidence

The phrase IDC infrastructure sounds mundane, but it is one of the most important terms in the dossier. An Internet Data Center is not a household accident. It is rented, provisioned, powered, monitored, and billed as a deliberate service environment. When repeated hostile traffic emerges from China Telecom IDC-linked ASNs such as AS4812, AS134238, AS140527, and AS134756, the relevant model is not botnet ecology alone. It is service ecology: who can rent, who can remain online, who gets reviewed, and who is allowed to keep generating abuse.

IDC provenance does not magically convert all customer misuse into state tasking. But it does change how mature abuse handling should look. A provider with billing relationships, customer records, internal metadata, and segmentation controls has more ability to investigate than any victim receiving the traffic. This flips the usual rhetorical burden. If the provider still does not remediate, outsiders are entitled to ask whether non-remediation is accidental, under-resourced, or strategically tolerated.

There is also an intelligence-history angle here. States have long preferred environments where infrastructure control is layered through nominally commercial entities. The arrangement provides deniability, compartmentation, and cost efficiency. IDC-hosted abuse inside state-linked telecom ecosystems fits that tradition neatly. It gives you professionalism without uniforms, persistence without formal acknowledgment, and enough paperwork to blur direct causality.

The diplomacy of non-remediation

China Telecom's significance is not only technical. It is diplomatic. Every unresolved abuse complaint, every shrugged route controversy, and every recurrent telemetry spike teaches the outside world something about the terms on which Chinese infrastructure wishes to be engaged. The lesson is simple: connectivity may be offered as a service, but accountability is offered conditionally and often grudgingly.

This has strategic effects beyond the individual incident. Foreign operators, researchers, and governments eventually adapt by assuming low cooperation. That assumption then feeds sanctions, procurement restrictions, peering caution, and political distrust. In other words, permissive abuse environments do not merely expose victims in the short term. They degrade the provider's long-term legitimacy as a neutral participant in global infrastructure.

What the subpoenas and late-stage policy escalation imply

The December 2024 Commerce crackdown and the March 2025 subpoenas matter because they show that China Telecom concerns did not end with the 2021 FCC revocation. Governments tend to move from warning to licensing action to broader investigative posture only when a problem resists symbolic treatment. In policy terms, subpoenas mean somebody decided the public record was insufficiently reassuring and that deeper documentation was worth compelling.

For network defenders, that is a useful clue. It suggests that institutional concern around China Telecom is cumulative and still alive, not an artifact of Cold War-style rhetoric recycled for headlines. The dossier's telemetry sits inside a live policy trend rather than a dead historical controversy.

The practical implication is not that every observer should outsource judgment to U.S. agencies. The practical implication is that private researchers and state institutions are converging on the same discomfort from different evidence bases. That convergence is usually where serious risk starts becoming undeniable.

What skeptics still get wrong about backbone neutrality

Skeptics often assume the argument in Part E is emotional: large Chinese network, scary headlines, therefore suspicion. That caricature fails because the case does not depend on fear of size. It depends on the interaction between size, capability, history, and observed concentration:

• If AS4134 were merely huge — it would deserve study.
• If it were merely controversial — it would deserve caution.
• If it were merely present in a few scans — it would deserve monitoring.
• What makes it exceptional is the convergence of all four conditions at once.

Neutrality is not a metaphysical property. It is performed through response. When an operator repeatedly demonstrates that it can regulate traffic for domestic political reasons but rarely exhibits corresponding urgency when foreign victims document outbound abuse, neutrality stops being a useful presumption. It becomes a marketing memory from an earlier internet that no longer exists.

There is another mistake skeptics make: they assume responsibility must be either total or nonexistent. In reality, infrastructure responsibility is graduated. China Telecom does not need to personally originate every hostile packet to be part of the operational problem. It only needs to repeatedly provide the substrate, keep the substrate attractive, and fail to create visible counter-pressure strong enough to change attacker behavior.

Once that framework is accepted, the debate becomes much more practical. We are no longer arguing over whether every incident can be attributed to a ministry. We are asking whether the backbone behaves like a system foreigners can prudently trust. On the evidence available here, that trust would be naive.

Strategic forecast: what AS4134 likely represents going forward

The future significance of AS4134 is not limited to the particular IPs in this dataset. Backbone networks matter because they sit upstream of future campaigns. As Chinese cloud, telecom, and overseas infrastructure projects continue to expand, the strategic relevance of backbone-adjacent tolerance grows with them. Every new dependency, every new data center, every new peering relationship increases the consequences of selective enforcement at the core.

That means defenders should think prospectively. The question is not only what China Telecom has already allowed or what regulators have already sanctioned. The question is what kind of environment this backbone will create for the next wave of gray-zone activity, especially when paired with the legal authorities and external infrastructure expansion discussed in later parts of the series.

Why backbone scale itself becomes strategic evidence

Small providers can sometimes credibly plead that they did not see the pattern soon enough. Backbone operators of continental scale cannot make the same plea indefinitely. Scale creates obligations because scale creates visibility, tooling, capital, and institutional memory. A network that can maintain national transit and international peering at AS4134's size has already solved harder engineering problems than identifying repeated SSH abuse concentrations leaving the same state telecom family.

This is one reason Part E treats size not as spectacle but as evidence. The larger the infrastructure, the less believable helplessness becomes. A world-class backbone has SOC functions, routing teams, abuse staff, policy controls, and relationships with downstream customers that a victimized target can only dream of. If remediation remains weak, analysts are entitled to move from capacity questions to incentive questions.

In the Chinese context those incentive questions inevitably become geopolitical:

• What traffic gets prioritized for control?
• What behavior triggers immediate intervention?
• Which foreign complaints matter?
• Which tenants remain useful enough to tolerate?

None of these questions require public answers to affect real-world risk. They only require repeated patterns that make the absence of answers informative.

Analyst Summary

• Complexity increases obligations, not reduces them. A backbone of this magnitude accumulates tools, staffing, and telemetry unavailable to smaller operators. If hostile behavior still escapes suppression, that reveals priorities.
• Temporal depth matters. Incidents from 2010, 2018, 2019, 2024, and 2025 all point back to China Telecom. Risk that outlives headlines is structural risk.
• No master key needed. The same ecosystem can host SSH abuse, tolerate IDC tenants, and appear in routing controversies without requiring a single explanation. Multiple ugly patterns clustering around one actor is itself the finding.
• Backbones are supposed to feel neutral. When one repeatedly becomes part of the political story, something has shifted in the nature of the internet. ChinaNet is not just carrying the traffic. It has become part of the evidence.

China Telecom is often described either as a telecom company or as a national-security concern, as though those labels compete. The evidence suggests they overlap. The company is strategically important precisely because it is a telecom company — because it moves real traffic, sells real services, and can hide power inside infrastructure the world prefers to imagine as neutral.

The right response is not to declare every packet from AS4134 malicious. That would be analytically sloppy. The right response is to assign the network family a different baseline of trust, a different escalation posture, and a different burden of reassurance than would apply to an ordinary commercial operator with a cleaner history.