Is there a database of this so people can check if their devices are compromised?
I dumped the ASN owners for a bunch of sources, the top 3 are:
15664 BR TELEFNICA BRASIL S.A, BR
15215 VN VNPT-AS-VN VNPT Corp, VN
15112 CN CHINANET-BACKBONE No.31,Jin-rong Street, CN
I'd say if you can telnet to your wan IP and get a login prompt, you have a shitty router that exposes telnet to the world and you're probably compromised :-)
Shouldn't they? It eats a lot of their outbound bandwidth. Even if they have peering agreements that they don't have to pay for, there's still the cost of the equipment and their internal network bandwidth to consider.
Having google or facebook check REMOTE_ADDR for every client would work though, but most people wouldn't understand what the notification means. Plus, on a network that isn't using nat you'd never get the alert since the IoT device itself would never be REMOTE_ADDR.