Do you know whether recurring attacks often come from the same attacking machines, so that there would actually be a significant decrease in the number or severity of the attacks ones the attackers are reported? What I'm wondering is if the money and effort spent on reporting the issues will benefit the one who's doing the work, or all network administrators everywhere? The latter might mean that the problem suffers from a version of the tragedy of the commons [1], where no one wants to do the work since the benefits are shared by everyone.