I did a whois on the IPs I was given and found they were owned by one ISP and were all in a similar range so there's that. A lot of ISPs (especially T-Mobile) lease IP space out like this too: https://rasbora.dev/blog/detecting-residential-proxy-network.... I would probably be paying a lot less if they were unethically sourced.

In general, if a provider advertises a 5-figure-IP-sized "pool" of IPs with a guaranteed number of "ports" (simultaneous connections), then the operator is almost certainly someone looking to monetize a botnet. Usually the cheapest plan would be something like pool of 20000 IPs - 500 connections, with the number of connections maxing out at 1/4-1/2 of the total IPs due to diurnal dynamics (people in major botnet victim countries like India/China often turn off their routers every night). Also advertising really specific geotargeting is often a sign that they are marketing to carders. The Krebs articles about awmproxy/TDSS are pretty good if you enjoy reading about this kind of thing :)

https://krebsonsecurity.com/2011/09/rent-a-bot-networks-tied... https://krebsonsecurity.com/2022/06/the-link-between-awm-pro...