If we're naming and shaming cloud providers who enable bad actors, may as well also remind everyone that nearly every* DDoS-as-a-Service provider uses Cloudflare to keep their sites online and origins hidden. It's been the case for years and they do nothing about it unless compelled by law enforcement, which is convenient for a company whose bread and butter is DDoS mitigation.

* the few exceptions use the Russia-based DDoS-Guard, not any of Cloudflares mainstream competitors, who all seem to be willing and able to turn DDoSers away.

https://en.wikipedia.org/wiki/DDoS-Guard