Chiming in. abuse@hostingprovider will work.

And yes, it would mean shut the sites down in some cases - the ClickFix stuff for WordPress is near-impossible to clear while the site is online.