Of course, this is a whole different level of culpability than if they were actually condoning large scale attacks on other countries infrastructure.
The fact remains that if I were to plot the amount of ip's that come knocking at my non-production server you'd see over 50% coming from china.
17.18% of all desktop OS-es connected to the internet are Windows XP, the version for which Microsoft doesn't publish updates. Most of these computers are in China. Also "in 2009, approximately 80% of software sold in China was pirated."
The average weekly income of a Chinese worker is around 100 USD. He is not going to buy new software even if it costs the same as in the US. It typically costs even more.
Don't be surprised bots have easier targets there.
Hint: port 9415
1) use a different port 2) use ip ban 3) use a firewall with range blocking -
Or do you have a good reason for allowing access from every ip on the internet?
EDIT: removed snark
tail -n 50 /var/log/auth.log
Nov 12 15:33:28 VPS-3167 sshd[11950]: Connection closed by 122.225.97.110 [preauth] [SNIP]
Nov 12 20:12:51 VPS-3167 sshd[12016]: Connection closed by 61.174.50.164 [preauth] [SNIP]
Nov 12 20:40:44 VPS-3167 sshd[12031]: Connection closed by 122.225.97.72 [preauth]
The list goes on and on, and the ip's in the last fifty lines were all Chinese or Russian, still they could also have been hacked themselves.