China (CN) Threat Intelligence

CN

China has 572,336 malicious IP addresses with 26,309,223 abuse reports. Top threat categories include tcp scan, suspicious activity, malware distribution, high threat, severe abuse. Top attacking networks: Chinanet (183,466 IPs), CHINA UNICOM China169 Backbone (175,522 IPs), Hangzhou Alibaba Advertising Co.,Ltd. (21,132 IPs). Data collected since 2022-07-02, last activity 2026-10-13.

Threat Assessment: China is one of the most significant sources of cyber threats globally, with an exceptionally high volume of malicious IP addresses. The dominant attack types are tcp scan, suspicious activity, malware distribution. The majority of threats originate from networks operated by Chinanet and CHINA UNICOM China169 Backbone.

Total Reports
26,309,223
Unique IPs
572,336
First Seen
2022-07-02
Last Activity
2026-10-13

Top Threat Categories

Tcp Scan 3,014,852
Suspicious Activity 1,602,365
Malware Distribution 1,285,371
High Threat 1,081,584
Severe Abuse 121,646

Top Attacking Networks

AS4134 Chinanet
183,466 IPs
AS4837 CHINA UNICOM China169 Backbone
175,522 IPs
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.
21,132 IPs

Most Reported IPs in China

36.33.167.165 1,624 reports
221.228.203.3 1,615 reports
117.81.212.152 1,606 reports
101.89.141.184 1,593 reports
125.124.226.217 1,592 reports

Access this data via API

Get China threat intelligence programmatically.

curl https://ip.wayscloud.services/api/country/CN

View full API documentation

See how we classify and verify threats →

Check any IP from China

Look up threat intelligence for a specific IP address.

Related: Country Threat Ranking Country Risk Trends → Top Malicious IPs → AS4134 Intelligence AS4837 Intelligence AS37963 Intelligence Global Attack Trends Detect Malicious Traffic

Loading threat intelligence data...