🇨🇳 China: live cyber threat activity

Malicious IPs, malware and ransomware victims in China.

10,752Malicious IPs listed#2 of 182 countries · 16.26% of the world
1,798New in the last 24hfirst seen by any feed
1,920Reported by 2+ feedsindependent sources agree
1Ransomware victimsposted in the last 30 days

View China on the live map →All listed IPs in ChinaRansomware victims in China

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C2409
  2. Malware4,898
  3. Phishing0
  4. Attacker5,445

By state or region

  1. Henan2,587
  2. Beijing1,615
  3. Liaoning1,046
  4. Guangdong968
  5. Shandong705
  6. Zhejiang587
  7. Jiangsu525
  8. Shanghai421
  9. Fujian231
  10. Sichuan212
  11. Jilin175
  12. Hubei170
  13. Hunan167
  14. Guangxi163
  15. Yunnan144

By city

  1. Zhengzhou2,536
  2. Shenyang1,035
  3. Guangzhou759
  4. Beijing733
  5. Jinan675
  6. Hangzhou489
  7. Jinrongjie416
  8. Nanjing395
  9. Chaowai341
  10. Shanghai310
  11. Chengdu198
  12. Shenzhen161
  13. Kunming142
  14. Jilin City135
  15. Qingyuan130

Networks hosting the most

NetworkIPs
AS4837 CHINA UNICOM China169 Backbone 5,016
AS4134 Chinanet 1,944
AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 815
AS45090 Shenzhen Tencent Computer Systems Company Limited 289
AS9808 China Mobile Communications Group Co., Ltd 277
AS137718 Beijing Volcano Engine Technology Co., Ltd. 257
AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd. 181
AS17816 China Unicom IP network China169 Guangdong province 172
AS4808 China Unicom Beijing Province Network 97
AS4812 China Telecom (Group) 82
AS23724 IDC, China Telecommunications Corporation 76
AS140293 China Telecom 72
AS141679 China Telecom 51
AS56046 China Mobile Communications Corporation 49
AS17638 ASN for TIANJIN Provincial Net of CT 48

Malware families served from China

  1. Cobalt Strike307
  2. AdaptixC226
  3. VShell23
  4. Mozi10
  5. DeimosC27
  6. Jackskid4
  7. Chaos3
  8. Farfli3
  9. DanaBot3
  10. VBREVSHELL3
  11. Amadey2
  12. Upatre2
  13. Deimos2
  14. Havoc2
  15. SNOWLIGHT2

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
125.40.158[.]82MalwareMalware downloadZhengzhou, HenanAS4837 CHINA UNICOM China169 Backboneaggregated list2026-10-12 08:23
123.173.109[.]117MalwareMalware downloadJilin City, JilinAS4134 Chinanetaggregated list2026-10-12 08:22
116.177.174[.]231AttackerOn multiple blocklistsJinrongjie, BeijingAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:20
220.181.108[.]158AttackerAttacking hostBeijing, BeijingAS23724 IDC, China Telecommunications Corporation1 feed2026-10-12 08:20
49.115.217[.]99AttackerAttacking hostXingfulu, XinjiangAS4134 Chinanet1 feed2026-10-12 08:20
60.170.197[.]78AttackerOn multiple blocklistsHefei, AnhuiAS4134 Chinanet1 feed2026-10-12 08:20
182.117.155[.]139MalwareMalware downloadZhengzhou, HenanAS4837 CHINA UNICOM China169 Backboneaggregated list2026-10-12 08:17
1.14.149[.]30AttackerAttacking hostGuangzhou, GuangdongAS45090 Shenzhen Tencent Computer Systems Company Limited1 feed2026-10-12 08:10
1.24.16[.]159AttackerAttacking hostZhangzhou, FujianAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
1.24.16[.]73AttackerAttacking hostZhangzhou, FujianAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
1.28.234[.]6AttackerAttacking hostZhangzhou, FujianAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
1.83.125[.]9AttackerAttacking hostXincheng, ShaanxiAS4134 Chinanet1 feed2026-10-12 08:10
110.179.81[.]214AttackerAttacking hostTaiyuan, ShanxiAS4134 Chinanet1 feed2026-10-12 08:10
111.113.88[.]105AttackerAttacking hostYinchuan, NingxiaAS4134 Chinanet1 feed2026-10-12 08:10
111.113.88[.]191AttackerAttacking hostYinchuan, NingxiaAS4134 Chinanet1 feed2026-10-12 08:10
111.113.88[.]251AttackerAttacking hostYinchuan, NingxiaAS4134 Chinanet1 feed2026-10-12 08:10
111.113.89[.]189AttackerAttacking hostYinchuan, NingxiaAS4134 Chinanet1 feed2026-10-12 08:10
112.195.202[.]157AttackerAttacking hostChengdu, SichuanAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
112.94.252[.]184AttackerAttacking hostGuangzhou, GuangdongAS17622 China Unicom Guangzhou network1 feed2026-10-12 08:10
112.94.252[.]215AttackerAttacking hostGuangzhou, GuangdongAS17622 China Unicom Guangzhou network1 feed2026-10-12 08:10
113.220.235[.]28AttackerAttacking hostQingyuan, HunanAS4134 Chinanet1 feed2026-10-12 08:10
113.95.138[.]105AttackerAttacking hostGuangzhou, GuangdongAS4134 Chinanet3 feeds2026-10-12 08:10
118.212.123[.]172AttackerAttacking hostNanchang, JiangxiAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
121.22.11[.]33AttackerAttacking hostShijiazhuang, HebeiAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10
121.29.149[.]37AttackerAttacking hostChengde, HebeiAS4837 CHINA UNICOM China169 Backbone1 feed2026-10-12 08:10

See every listed IP in China →

Ransomware victims in China

1 posted in the last 30 days, 19 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-12 09:01瑞祥机电 (Ruixiang Jidian)medusalockerManufacturing
2026-09-01 09:00reignwoodpark.comkrybitHospitality
2026-08-30 09:29esopartnerscpaZaWooProfessional Services
2026-08-28 15:02Hangzhou Qihan Biotech Co., Ltd.globalHealthcare
2026-08-28 15:02Shanghai Tunnel Engineering Co LtdglobalTransportation
2026-08-28 15:01AtcommglobalTechnology
2026-08-25 19:23copcp.comchaos—
2026-08-22 14:00RXPE GroupcoinbasecartelManufacturing
2026-08-12 15:38HONGHE-TECH.COMclopTechnology
2026-08-07 12:50MINDRAY.COMclopHealthcare
2026-08-07 08:40laticrete.com.cnL GroupManufacturing
2026-08-06 08:31RS Automation Co., Ltd.BarracudaManufacturing
2026-08-03 09:52BaicizhandragonforceTechnology
2026-08-03 06:52TUI ChinadragonforceHospitality
2026-07-27 23:21JD Youngtermite—

All ransomware victims in China →

Other countries

🇺🇸 United States 17,807🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →