ISPs are dunning users about "illegal" file sharing. Because of pressure from MPAA etc. These IoT botnets are just testing capabilities, and they're already formidable. Going after operators is good, but it's so damn easy to hide. It seems that IoT botnets are using mainly direct attacks, so they're easy to identify. And why would ISPs want to support botnets? Don't ISP ToS typically say that attacks, threats and spam are grounds for service termination?

Maybe this isn't Dyn's job. Maybe some neutral NGO should handle it. But seriously, this is something I could do at home, on an old gaming box in MySQL. If I had the list of IP addresses, anyway. But why? How about acting in the public interest? Or good PR?