In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

I'm currently fighting this battle.

As of this morning:

  80% of malicious traffic comes from Azure.
  10% from Digital Ocean.
  5% from AWS.
  5% from GCP.