Is it worth the time and effort to email the Whois abuse contacts when an IP is probing a web server? Not likely. Unless there is evidence captured proving so

Is it worth the time and effort to email the Whois abuse contacts when an IP is probing a web server? Not likely. Unless there is evidence captured proving someone hacked your machine and did damage, the reports to the domain owner will be ignored or never seen. Reports to the ISP will be ignored. Or worse, they wont be ignored and the ISP just pits you against the compromised server owner who will be in denial and/or won't know what to do. I find it best to just set environment variables and ACL's to just ignore the attacks. Maybe send them to a dummy page served entirely from RAM or a ram disk and set logging to /dev/null. I would not even bother blocking them. The C&C nodes will detect an edge node can't reach you and will just try at some point from another compromised host. I'd just give them a lightweight error served from ram to reduce disk IO and bandwidth. If you are bored, something fun to do is make pages that cause the bot to go into recursion loops on your site with dummy pages that have keywords like "Wordpress, cpanel, admin" and that link to each other ...etc. A clever error page can do this in a single page but make it look like infinite pages via relative links. If the probes are to SSH then just use SSH keys and disable password authentication. Let them probe away. If it's really annoying then firewall restrict SSH to your ISP's CIDR blocks to reduce the noise, and/or move SSH to a high port to reduce noise not for security. If that is not enough I can suggest something that will make your SSH invisible to 90%+ of the bots without moving to a high port.