I have several honeypots on different services (some of them mimics industrial automation systems like SCADA), and the majority of these attacks are coming from China, followed by the US and then the Netherlands.