points
I'm currently fighting this battle.
As of this morning:
80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.