[openasocket]

From a rational self-interest standpoint, bots tend to get their IP addresses blocked by whoever they're targeting. Which means the Amazon IP address space gets on threat lists and block lists. The bot owners can just generate new instances with new IP addresses, and then some legitimate customer spins up an instance and gets their address, and wind up on blocked. The bots keep going until various services decide to just block all of Amazon's space, the same way they would for Tor exit nodes or other things associated with shady activity.