IMHO this would be an easier problem to address with a voluntary body that coordinates among ISPs or (cringe) a govt. agency. I worked for a popular service th

IMHO this would be an easier problem to address with a voluntary body that coordinates among ISPs or (cringe) a govt. agency. I worked for a popular service that regularly received DDoS attacks from botnets. We had logs with the IPs of tens of thousands of vulnerable devices. If you scanned them you could see the vast majority were compromised routers, VPNs, or IoT devices. Most of them had open proxies installed and were easy to identify as compromised. For the larger ones we could reach out and get them shut down (usually). But we didn't have time to contact thousands of ISPs. I would've been happy to forward those logs, even with verification of compromise, to an independent body that could follow up and get them shut down. Even if a small fraction of ISPs didn't comply it would still remove the majority of compromised devices. Most of the companies we contacted were more than happy to get rid of problematic hosts and acted quickly. They just didn't have the expertise to monitor for such things themselves. It would all have to be voluntary, of course, but it could be done. This is the type of thing that I think CERT was originally intended for, but for whatever reason doesn't seem to handle.