In general, if a provider advertises a 5-figure-IP-sized "pool" of IPs with a guaranteed number of "ports" (simultaneous connections), then the operator is almost certainly someone looking to monetize a botnet. Usually the cheapest plan would be something like pool of 20000 IPs - 500 connections, with the number of connections maxing out at 1/4-1/2 of the total IPs due to diurnal dynamics (people in major botnet victim countries like India/China often turn off their routers every night). Also advertising really specific geotargeting is often a sign that they are marketing to carders. The Krebs articles about awmproxy/TDSS are pretty good if you enjoy reading about this kind of thing :)
https://krebsonsecurity.com/2011/09/rent-a-bot-networks-tied... https://krebsonsecurity.com/2022/06/the-link-between-awm-pro...