[luckylion]

I'd love to see that, but I don't think it'd work because most people aren't capable enough to disinfect their machines and you can't just block their access to the internet.

I expect locked down devices like cell phones and tablets to be less problematic in that regard (but maybe that's not true at all), so maybe the home-botnet-issue will resolve itself as more and more people stop using personal computers?

I have no way to tell how the big Cloudproviders actually handle it. I've occasionally reported persistent phishing campaigns to SES & similar providers and never really got a reply. I've reported a DDOS to Azure and it took them 18 days or so to say "thanks, we'll forward it". If Microsoft and Amazon don't respond appropriately, how can we expect smaller ISPs to handle that?

[ftrobro]

> you can't just block their access to the internet

Or maybe that's the best thing you can do for them, perhaps preventing them from revealing even more passwords etc to the attacker.

[lxgr]

> [...] maybe the home-botnet-issue will resolve itself as more and more people stop using personal computers?

Maybe – if there wasn't IoT/smart home devices...

[luckylion]

Ah, yeah, I forgot about those. And with remotely triggered updates, you don't even need to get past the router to infect some fridge, you just take over the manufacturer's site (or wait until they let the domain expire...) and have the fridges come to you.