In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
I'm currently fighting this battle.
As of this morning:
80% of malicious traffic comes from Azure.
10% from Digital Ocean.
5% from AWS.
5% from GCP.
Closer to 95% if you count Teams.
Mine is very similar, but with DO and AWS swapped around.