Is it the default behavior of major carriers in Russia/China/Africa/etc as well as in Europe/America?
My experience has been that the majority of the countries where attacks come from do not really care.
My experience has been that the majority of the countries where attacks come from do not really care.
You need relatively low capacity to start an amplification attack, so a server at some ISP which doesn't care is enough. There are some ISPs which knowingly allow this, like Ecatel in The Netherlands which is probably the most notorious example.