It is not so simple. I've seen abuse complaints to the abuse contacts of the RIRs (that, in the end, are in the top of the chain of "owners" of those IP blocks

It is not so simple. I've seen abuse complaints to the abuse contacts of the RIRs (that, in the end, are in the top of the chain of "owners" of those IP blocks) or intermediate owners that lease those ranges or distribute them among their clients. Sending to the wrong targets (specially, in an automated way, there are scripts that does that) will end you getting ignored, and the reports of the IPs that they actually use may get lost because the noise. And besides that, there are different ways to use those addresses, and the owner of them may not know, or could not have policies to deal with them. What you do with residential IPs? Will you block/penalize your users if somehow their connection was used to launch an attack? Even if they are not aware of that happened? Different ISPs in different countries could have different policies. What about big hosting companies? There are more shades of grey there, specially when those outbound IP addresses could be used by several clients. For entire servers to vulnerable web applications in shared servers to ways to dynamic launching workloads with IPs from common pools, is not trivial. But it should matter for small enough companies, where that activity was launched by their own administered servers, because exploited vulnerabilities or rogue employees. Or companies that take some action because internal or clients hostile activity. Anyway, besides complaining to abuse reports, you have more ways of action. You can block IPs or IP blocks (if connections are coming from an ISP, country or hosting company where you not expect to get actual users for your service. You can use fail2ban or some WAF to block those IPs as soon as some known attack pattern is detected. Or you can use them to monitor your infrastructure, in the sense that if some of those attempts for an URL get a 200 status code or something like that launch an alert. Also, using RDAP (https://en.wikipedia.org/wiki/Registration_Data_Access_Protocol https://en.wikipedia.org/wiki/Registration_Data_Access_Proto...) should be better than using whois.