Probably not spoofed, I see a lot of scanning from China.

route:        121.8.0.0/13
descr:        From Guangdong Network of ChinaTelecom
origin:       AS4134
mnt-by:       MAINT-CHINANET
changed:      dingsy@cndata.com 20060707
source:       APNIC

person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy@cndata.com 20070416
mnt-by:       MAINT-CHINANET
source:       APNIC

-Patrick

----- Original Message -----
From: "Rich Sena" <ras@thick.net>
To: "NANOG" <nanog@merit.edu>
Sent: Thursday, March 6, 2008 12:01:52 PM (GMT-0800) America/Los_Angeles
Subject: Scan traffic from 121.8.0.0/16


Anyone seeing anything similar - trying to determine if this is spoofed
etc...

--
Rich Sena - ras@thick.net
ThickNET Consulting
"On the way to understanding; you understand, and forget."