Too bad AWS didn’t get that memo, 200GB would cost $18 there, and somehow the company in the original post is paying $500 for that bandwidth with whoever their proxy host is.
There are usually a few layers of resellers so technically the proxy provider can throw their hands up in the air and say they are unaware of any malicious activity.
Someone has a cheap android tv box or similar unpatched thing with your wifi password
(one botnet alone has over 1.3 million android boxes working for it as of this week - https://www.securityweek.com/1-3-million-android-tv-boxes-in... )
Someone start cobbling lists of these so I can block them in a different way.