If someone reports to you that a bad actor (spammer, bruteforcer, whatever) is on your network, it would seem to eliminate your plausible deniability and safe h

If someone reports to you that a bad actor (spammer, bruteforcer, whatever) is on your network, it would seem to eliminate your plausible deniability and safe harbor defense. The real problem is economic; for any given ISP, they are going to side with their customers over some rando complainer most of the time. You don't get rich by disconnecting your own customers unless you absolutely have to. Sometimes, this is good, if you're the one who might get disconnected (Cox was a great ISP to have, because for many years they would blithely ignore Bittorrent complaints and give you a dozen or so 'strikes' without consequence); it's awful and obnoxious if you are on the receiving end of an attack, and some shitlord low-budget VPS reseller or datacenter operator won't unplug the control server or whatever, or drags their feet to a ridiculous extent. All about whose ox is getting gored.