[c00lio]

Same. 70% of SSH scanners we see is from some (red-)Chinese network. Distant seconds are Russia, Belarus, India. Sometimes, rarely, one sees some Western cloud provider or hoster, but there the activity is typically short-lived due to working abuse-handling.

Sibling comment mentions proxying, which would be an explanation. But still, there is absolutely no working abuse handling on Chinese or Russian networks. Either they do not care or are complicit.