If they are residential or business IPs, it would be nice for the ISPs to let them know something on their local network is part of a massive botnet.

why would they? I mean with how they are charging by the GB these days, it gives them financial incentive to not tell you your refrigerator (or any device) is part of a botnet, that's free money for them.

Assuming you mean this seriously and not just as a tongue-in-cheek dig at internet carriers...

Even if every refrigerator were on a pay-as-you-go plan, handling all of the data may ruin throughput for other customers, especially at peak usage.

That makes sense to me.

Yes, because an ISP has nothing better to do than waste money on contacting customers and telling them to unplug their refrigerators.

Not going to happen.

At some point, if the Internet is going to continue to function, one of the likely outcomes is that these customers wake up some morning and the only thing they can get is a web page telling them they have a choice of disabling their fridge's Internet of Shit device or connection, or doing without their full connection to the greater Internet.

Compare to, for example, our stopping our use of lead in paint and gasoline/petrol.

That's a good analogy. In many places, owners of lead-contaminated buildings must remediate. One issue, of course, is poisoning of resident children. But another is contamination of the surrounding environment. Paint manufacturers are also liable, but that's a separate issue.

Basically, this is just environmental pollution.

Well, https://en.wikipedia.org/wiki/Copyright_Alert_System is happening.

In this case the IPs probably aren't spoofed, but there's always the chance that you're blaming IPs that didn't engage in the attack but somebody just put it randomly as source address in their packets.

True. But once you have the IP, you can nmap to get the OS, right? That would probably exclude most false positives, where Mirai was implicated.

Probably not in cases where the device is behind a NAT/router that happens to forward remote access ports that lead to the initial compromise. Then you'd be nmapping the customer's endpoint. Plus, it'd be too time consuming. Tens of millions of participating IPs spread across countless ISPs...

Good point. But still, even with risk of false positives, I believe that ISPs should be informed. And ISPs could acknowledge uncertainty when informing customers.

But in many cases you don't even know if the IP addresses are spoofed or not.

> And maybe they could publicly shame ISPs that didn't act on the information.

so... all of them?

Why do you think Dyn should waste their time and money on this?

ISPs are dunning users about "illegal" file sharing. Because of pressure from MPAA etc. These IoT botnets are just testing capabilities, and they're already formidable. Going after operators is good, but it's so damn easy to hide. It seems that IoT botnets are using mainly direct attacks, so they're easy to identify. And why would ISPs want to support botnets? Don't ISP ToS typically say that attacks, threats and spam are grounds for service termination?

Maybe this isn't Dyn's job. Maybe some neutral NGO should handle it. But seriously, this is something I could do at home, on an old gaming box in MySQL. If I had the list of IP addresses, anyway. But why? How about acting in the public interest? Or good PR?