An analysis of Chinese hosting environments identified over 18,000 active malware command-and-control (C2) servers distributed across 48 infrastructure providers, with China Unicom hosting nearly half. The majority of malicious activity is C2 infrastructure (84%), followed by phishing (13%). Key malware families such as Mozi, ARL, and Cobalt Strike dominate C2 activity, supporting both cybercrime and state-linked operations. High-trust networks like China169 Backbone and CERNET are exploited, revealing persistent abuse patterns and infrastructure reuse across campaigns.