Nothing wrong with contacting the customer, and taking down the IP briefly until the customer can deal with their malware hosting toaster.

However, I can see the argument for giving the customer 24-48 hours to resolve the problem.