Your China Unicom Hebei province network Router is Attacking the Internet (And You Have No Idea)

---

title: "Your China Unicom Hebei province network Router is Attacking the Internet (And You Have No Idea)"

slug: threat-pattern-residential-botnet-121-29-51-28

excerpt: "Caught in the wild: 121.29.51.28 (China Unicom Hebei province network) - 165 abuse reports from 53 organizations. Real OSINT, real receipts."

category: threat-intelligence

tags: [OSINT, ThreatIntel, residential-botnet, CN, ddos-source]

author: Patrick Duggan

date: 2025-11-02

featured: true

---

# Your China Unicom Hebei province network Router is Attacking the Internet (And You Have No Idea)

**TL;DR:** 121.29.51.28 from China Unicom Hebei province network (CN) has been reported **165 times by 53 distinct organizations**. Pattern detected: residential-botnet. Confidence: 90%.

The Receipts

**IP Address:** 121.29.51.28

**ISP:** China Unicom Hebei province network

**Country:** CN

**Usage Type:** Fixed Line ISP

**Abuse Score:** 100/100

**Total Reports:** 165

**Distinct Reporters:** 53

**Last Seen:** 2025-10-28T23:56:57+00:00

Attack Pattern

**Classification:** RESIDENTIAL-BOTNET

**Severity:** HIGH

**Attack Types:** Web Scanning

Why This Matters

This is NOT a sophisticated attacker. This is someone's **home internet connection** that's been compromised. Could be:

- Compromised router (outdated firmware, default credentials)

- Malware on a home PC/laptop

- IoT device botnet (smart TV, security camera, etc.)

The owner has **NO IDEA** their connection is attacking servers worldwide.

Evidence Sample

Here are the first 5 abuse reports (out of 165 total):

Report 1 - 2025-10-28

**Reported by:** China (CN)

**Details:**

Report 2 - 2025-10-28

**Reported by:** Singapore (SG)

**Details:**

Report 3 - 2025-10-27

**Reported by:** United Kingdom of Great Britain and Northern Ireland (GB)

**Details:**

Report 4 - 2025-10-26

**Reported by:** Poland (PL)

**Details:**

Report 5 - 2025-10-26

**Reported by:** Estonia (EE)

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

**Details:**

Detection Methodology

**Pattern:** residential-botnet

**Confidence Score:** 90%

**Detection Factors:**

- ✅ Residential/Mobile ISP (not datacenter)

- ✅ High report count (165 > 100)

- ✅ Wide reporter base (53 distinct organizations)

- ✅ Credential theft attempts detected

What Defenders Should Do

Detection Rules

Mitigation

1. **Block this IP immediately:** 121.29.51.28

2. **Block ASN/range if persistent:** Check if entire range is abusive

3. **Monitor for pattern:** Look for similar residential-botnet activity

4. **Share intel:** Report to AbuseIPDB, GreyNoise, etc.

The Philosophy: Sunlight is the Best Disinfectant

We publish this because:

1. **Hoarding threat intel is morally indefensible** - If you know about a threat, share it

2. **Public attribution forces accuracy** - Show receipts or look stupid

3. **Adversaries hate documentation** - Makes their infrastructure useless once published

Raw JSON Evidence

---

**Data Source:** AbuseIPDB + Live Traffic Analysis

**Detection Time:** 2025-11-02T21:55:22.567Z

**Methodology:** Automated pattern recognition + manual verification

🧠 Generated by Central Brain - Autonomous Threat Intelligence

💰 Cost to bad guys: $0 (we publish for free)

🎯 Cost to defenders: Intelligence without the enterprise tax

*Want to dispute this? Email [email protected] with your traffic logs. We'll publish corrections if evidence supports it.*

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=your-china-unicom-hebei-province-network-router-is-attacking-the-internet-and-you-have-no-idea