Malicious IPs in China
IPv4 networks located in China that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
China at a glance
China had 2,204 flagged IPv4 networks in the snapshot of 2026-10-10, rank #2 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 6.43 flagged networks per million addresses, rank #51 of 77, well below the median of 10.6 across all rated countries. The largest category is brute force sources with 71% of the flagged networks, followed by other malicious networks (16%). The three networks (ASNs) with the most flagged IPs hold 40% of them, led by CHINANET-BACKBONE - No.31,Jin-rong Street (AS4134). Another 2 flagged IPv6 networks are located in China.
Malicious activity in China by category
A network listed in several categories counts once, in the most specific one. Also flagged: 2 IPv6 networks.
Brute force sources in China
1,569 (71%)1,569 flagged networks, #1 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Other malicious networks in China
355 (16%)355 flagged networks, #3 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Spam sources in China
187 (8%)187 flagged networks, #1 of 85 countries for spam sources. Sources of email spam. Spam Sources by Country
Botnet hosts in China
58 (3%)58 flagged networks, #9 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
C2 servers in China
23 (1%)23 flagged networks, #6 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country
Scanners in China
12 (1%)12 flagged networks, #15 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country
Networks with the most flagged IPs in China
Autonomous systems announcing the flagged networks located in China.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS4134CHINANET-BACKBONE - No.31,Jin-rong Street | 401 |
| 2 | AS37963ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd. | 262 |
| 3 | AS4837CHINA169-Backbone - CHINA UNICOM China169 Backbone | 223 |
| 4 | AS9808CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd. | 158 |
| 5 | AS45090TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited | 144 |
| 6 | AS38365Baidu - Beijing Baidu Netcom Science and Technology Co., Ltd. | 133 |
| 7 | AS137718VOLCANO-ENGINE - Beijing Volcano Engine Technology Co., Ltd. | 105 |
| 8 | AS4811CHINANET-SHANGHAI-MAN - China Telecom (Group) | 87 |
| 9 | AS4808CHINA169-BJ - China Unicom Beijing Province Network | 51 |
| 10 | AS4812CHINANET-SH-AP - China Telecom (Group) | 46 |
Compare China with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to China by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 49 | Algeria | 32 | 6.71 |
| 50 | Hungary | 39 | 6.58 |
| 51 | China | 2,204 | 6.43 |
| 52 | Germany | 777 | 6.14 |
| 53 | Chile | 64 | 6.06 |
| 54 | Venezuela | 39 | 5.82 |
Other countries in the APNIC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 3 | Bangladesh | 166 | 79.5 |
| 4 | Pakistan | 425 | 74.8 |
| 5 | Nepal | 41 | 70.0 |
| 8 | Sri Lanka | 26 | 46.1 |
| 9 | India | 1,777 | 42.3 |
| 11 | Hong Kong SAR China | 500 | 31.0 |
| 12 | Philippines | 188 | 30.0 |
| 21 | Indonesia | 408 | 21.0 |
Questions about China
- How many malicious IP addresses are there in China?
- On 2026-10-10, 2,204 IPv4 networks (/24 blocks) located in China were flagged for malicious activity, with 8,717 listed IPv4 addresses and 2 IPv6 networks. Each /24 counts once, however many of its addresses are listed.
- Which networks in China host the most flagged IPs?
- CHINANET-BACKBONE - No.31,Jin-rong Street (AS4134, 401 networks), ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd. (AS37963, 262 networks), CHINA169-Backbone - CHINA UNICOM China169 Backbone (AS4837, 223 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in China or anywhere else with one API call.