So yeah... since these hyperscale hosting provider are being an ass. I decided to block their whole ASN instead. 

AS8075 - Microsoft owned (must be Azure)
AS396982 - Google Cloud

also, these bastard are starting to use cloudflare network (probably the WARP VPN) to scan for vuln. ​:mangap:​ ​:brengsek:​

https://obj.misskey.id/media/6cf483a7-4c9e-4007-b3f1-d4764d535a3e.webp