Because there are a lot more computers in China than everywhere else?

I must be stupid, because to my understanding, the IP addresses an attack originated from is highly likely not the IP addresses of the attackers. I mean, there are things such as proxies, bots, zombies, etc. The only way to figure out where the attacks really came from is to go upstream at least one level and conduct forensic analysis of those machines. I am almost certain that Verizon didn't do that.