While some scans might come from that actual host owners, the vast majority are coming from compromised systems. If the ISP is responsible and investigates they

While some scans might come from that actual host owners, the vast majority are coming from compromised systems. If the ISP is responsible and investigates they will be shut off. Most types of scanning also violate the terms of service for almost all ISPs so even if the owner does claim it's a public service there's a decent chance they'll be shut off. If the scanner is brute-forcing or trying to exploit known vulnerabilities, for example. I know a lot of people will find this to be wishful thinking. I've run security for some fairly large businesses and reported more than my share of compromised hosts. Obviously we don't report every scanner because it's time consuming and the cost/benefit isn't there, but the percentage of companies that respond is far more than zero. I would say though, that you're less likely to get a response from a Whois contact for the IP than from a domain contact or a contact listed on the primary website of the domain owner. Whois contacts get so much spam they often go un-monitored.