I have a private web server that gets attacked a lot (brute forces, nmap scans). I would like to compile a list of the IP addresses that were trying to hack my server and publish them on my website. Is this legal? I realize that the IP address could belong to a botnet (so the owner of the IP address is unwillingly knows that it's comprised).
In general, you can publish anything unless an exception to the First Amendment applies.
The only exception that could plausibly be relevant is that you could be improperly defaming someone else's reputation.
If you have a good faith believe that these IP addresses were used to hack your server, this would almost surely be a matter of public concern (why else publish) and would involve a statement that was not false or made with reckless disregard for its truth or falsity.
To avoid inadvertently tarnishing someone else's reputation, you might consider including a notice that recognizes that the IP addresses could belong to a botnet and was not controlled by the legitimate owner of the IP addresses together with your "page of shame".