yeah they are growing, we noticed: my "ids" sensors grab malicious traffic originating from their ranges more frequently, compared to those originating from aws (which are plenty as well).