again it's a matter of cost. If you only have one IP, and say, many domains on that one IP, only one of which is a phishing site, it is a /whole lot/ of work

again it's a matter of cost. If you only have one IP, and say, many domains on that one IP, only one of which is a phishing site, it is a /whole lot/ of work for me (who really can only mess with things at the network level) to selectively take out one domain or one url. I mean, it can be done, but the equipment and expertise required to pull it off would drive up my costs. Now, if I was a 'fully managed' provider that had a login on all my customer boxes, in that case, assuming the problem was a customer of a customer phishing rather than a compromised server, it would be fairly easy to log in and fix it. But that's not how I'm set up.