That's the easy case, if they are preloaded in the OS, they are well-known by definition and can be blocked statically. The dynamically discovered ones are the

That's the easy case, if they are preloaded in the OS, they are well-known by definition and can be blocked statically. The dynamically discovered ones are the next step in the game, but you still have to start somewhere, either with well-known IP or at least legacy DNS.