I think that's mostly that they don't care about having malicious bots on their networks as long as they pay. GCE is rare in my experience. Most bots I see are

I think that's mostly that they don't care about having malicious bots on their networks as long as they pay. GCE is rare in my experience. Most bots I see are on AWS. The DDOS-adjacent hyper aggressive bots that try random URLs and scan for exploits tend to be on Azure or use VPNs. AWS is bad when you report malicious traffic. Azure has been completely unresponsive and didn't react, even for C&C servers.