Anecdotal point of data: M247 seems to run a lot of bad-faith traffic as well - while a service I run tries to keep block lists minimal even for frequently abused endpoints (eg credential stuffing) their ASNs are a mainstay in there.