When something like this happens, do security researchers instantly contact the hosting companies to suspend or block the domains used by the attackers?
Domains might get added to a list for things like 1.1.1.2 but as you can imagine that has much smaller coverage, not everyone uses something like this in their DNS infra.