@dalias @soc @stuartl @thesamesam @mgorny I do think there's few things ISPs could do without involving deep-packet inspection (illegal in quite few places for them to do). For example having some honeypots for both the residential side and hoster side, specially as most home ISPs also tend to have a hoster venture.

And then actions taken can be things like having the controlling IPs go into a list of IPs that can be used in say an opt-in list used by their users' firewalls.