After analyzing 350K+ IPs, here’s what we learned about ASN abuse, Tor behavior, and why blocklists alone aren’t enough.