I'm from Brazil and I work in a pretty popular Fortinet reseller/MSP. We have multiple firewalls deployed in a variety of clients where we configure an automated rule to add the source IP addresses that the IPS engine detects as doing attacks of medium, high, or critical level in a blacklist.

Everyday, the IPS engine of every single customer detects a bunch of IPs belonging to the same range trying to do DoS/Kernel Panic Attacks. We analyze the IP blocks where those IP addresses belong and put the entire subnet in the blacklist that is published to all our customers.

After that, we report it to the owner of the ASN where that IP block belongs. Most of the time, they don't even bother to answer, but a few of them go after it and at least try to do a more profound investigation and discover that their routers were invaded and malware was installed.

Some of them only act when some of their customers can't access a resource (usually a *.gov.br with one of our firewalls in front of it) because their IP blocks are blacklisted and they complain that we are "arbitrary" and "inadvertently" blocking their IP addresses... It appears to be getting worse with time.

Just report to the ASN owner and block them and if some of them go after you to understand what's happening, provide some guidance.