Additionally some VPNs route through legitimate devices.
The only way I’ve seen this somewhat work is to have a complex system that pulls apart the connection info, and then you use a combination of data science + threat intel + good ol’ reversing to make decisions of if something is malicious or not. Then you need multiple teams to run and tune these functions as attacks change.
Or if someone added my phone number as a prank, a revenge or an attack on me?