Ege Demir traced it back to AS132510, which would invalidate the Volcano Engine or BytePlus theory, but AS132510 is so frequently a routing hop in Chinese net traffic that I feel it can be discounted.

Otherwise, it could very well be ByteDance leasing compute (I think they mainly use AS150436?).