I routinely register lapsed malware C2 domains and sinkhole them to collect information on what information they gather. I currently have about 30k infected hosts that phone home every minute or so asking for shell commands to execute. Most of these hosts are on popular providers like HostGator, BlueHost, etc. I've tried reaching out to them to tell them about it but didn't get anywhere.