We contact the ISPs who have compromised hosts.  Most ISPs don’t have a decent security team and wait for a support issue to finally arise before even looking for a problem.

We see malicious hosts, find out who the ISP is and call them.