[geofft]

For spam / malicious traffic / botnets, our answer to all of those is historically "Yes," and it's worked fine for the growth of the internet so far. It's of course much easier to get a lazy cloud host, registrar, or ISP to take someone offline if the FBI is involved and gets a court order, but it's always been the expectation that there's an abuse contact who will respond to reports from the general public. Every domain or netblock entry in WHOIS has an abuse contact, implying there's some consensus standard of "abuse."