If you look at my previous posts on HN I've written extensively about this topic.
Ignore some (but not all) of the dissenters on here. I don't mean to be rude, but these fake hosting companies are backed by quite the army of pr crisis tech support people, and they will dogpile on a thread like this quickly. You'll sometimes see them leave Yelp and Google Local reviews of their beloved friendly neighborhood data center too (which is preposterous no one does this in real life).
Anyway the clusters you are seeing do not appear to be about observation as much as destruction. From the analysis that I and others have done, our best guess is that someone is buying out hosting provider after hosting provider, and then peering at the 1 Gbs and 10 Gbs level as much as possible.
The purpose of this is two fold. First you are denying your enemy freedom of movement in that area. So think "squatting" or just taking up the board in monopoly.
The second more disturbing piece is that someone is building a kind of DDOS death star that will be unlike anything seen so far. From all the papers I've read, such an attack is likely to come through some novel IOT exploit and perhaps using one of the newer protocols like MQTT or COAP. But owning this much hosting space would be a terrific backup / serve as good defense for the expected counter attack.
This does not bode well at all for Europe. Even if the internet was off for months in the US the country could recover and rearm. All of Europe on the other hand, if stripped of the internet, could be overtaken in weeks if not days if Russia or China were so motivated.
The enormous capital expenditures that these IaaS providers have been sustaining points to China most certainly. Check out also Choopa, Tucows, Enom, Psychz, Shaw, Sharktech, Joe's Data Center, Hetzner, UnityMedia, Incapsula, and Mimecast.
This report is also very helpful : https://transparencyreport.google.com/safe-browsing/malware