It's mind boggling that selling VPN services became a thing. Was I the NSA or any state level actor, selling a VPN service as a front seems the best thing to do to cast a pretty wide net.
Apart from using a deny list that you can find on Github, you just look at the size of the subnet the IP is coming from in WHOIS output. VPN IP adresses are part of very small subnets unlike legit ISP ip addresses that come from wide subnets
https://github.com/ugjka/flipbot/blob/master/trigger_vpn.go (it is not pretty, i know, but it worked)
Yes, AT&T has been shown to be doing all these things.
Also recall that multiple ISPs have been caught tracking their users and selling their user’s data.
The expansion of secure connections limited that to a degree, but we know ISPs are still extracting and selling data based on their response to people switching over to encrypted DNS requests.