---
id: 6201
title: "Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs"
source_domain: hunt.io
source_url: "https://hunt.io/blog/china-hosting-malware-c2-infrastructure"
published_at: "2026-01-14T00:00:00Z"
tags: ["cloud", "threat-intelligence", "threat-hunting", "china", "command-and-control", "hosting-providers", "mozi"]
phying_url: "https://phying.com/item/6201"
lang: en
---

# Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

## Summary

Host Radar found 18,000+ active malware C2 servers across 48 Chinese providers, China Unicom, Alibaba Cloud and Tencent dominating; Mozi, Mirai and Cobalt Strike drive most framework-based abuse.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-01-14T00:00:00Z
- **Original:** https://hunt.io/blog/china-hosting-malware-c2-infrastructure
- **Phying News:** https://phying.com/item/6201