What's interesting to me is how split into node type the Internet is. All the servers are Google/AWS/Azure, but there are almost no legitimate clients on those

What's interesting to me is how split into node type the Internet is. All the servers are Google/AWS/Azure, but there are almost no legitimate clients on those ASNs. I've also done AS blocking (preventing certain IPs from getting a free compute trial without human intervention; this was back in the crypto days), and indeed, blocking the networks that you did is great for getting rid of bots and harms 0 legitimate users. (I think the big culprit is "free for open source" CI systems; they tend to be hosted on the major cloud providers and I found those doing a lot of command-and-control. I'm surprised those are viable to keep around for free, though.)