Despite a -20% decrease,
US-based "charter.com" is #1 for hosting IPs associated with exploited devices: 139, 714 detections over the last 30 days....
....as well as 166 Spamhaus Blocklist (SBL) listings.
Spamhaus reputation statistics: https://www.spamhaus.org/reputation-statistics/networks/exploit/
https://charter.com
SBL listings: https://check.spamhaus.org/sbl/listings/charter.com/