As someone that deals with sinkholed malware domains everyday, I have to day I slightly disagree with the logic and approach behind it. The basic premise is th

As someone that deals with sinkholed malware domains everyday, I have to day I slightly disagree with the logic and approach behind it. The basic premise is that unwitting hosts are compromised by malware,this malware is talking to a domain and in order to protect the infected users and curtail the further spreading of the malware the domain is sinkholed. First, a random authority, regardless of legal relevance has no standing to "protect" infected hosts without explicit consent of the owners. If the infected host is causing harm to other internet hosts then it needs to be taken offline by it's network owner (e.g.: isp or datacenter operator that owns the IP AS number). Second, in case of malware spreading (e.g.: wannacry) and DGA domains: if the domain is not registered, instead of a sinkhole, an administrative restriction on registering that domain should be placed. If the domain is registered, you want the IP infrasructure to be taken down. IP blocks an reputation damage can be very harmful. IP subnet owners are much more responsive and where that is not the case, a null route can be blaced to "sinkhole" the IP -- null routes are advertised using predefined BGP communities, this means it will be unreachable only by networks that accept that community (e.g.: FBI sinkholes an IP, american networks accept the community and block the IP while other countries might not). You have to understand why there are so many malware domains for C2 and why DGAs exist, it is more costly to become in control of an IP address than it is a domain. If you block the IP as soon as C2 is detected on it,the attacker will just change the A record to point to another IP, but they have a much more limited set of IPs and costly IP infrastructure so they'll be running out of them fast. You can use DGA and dynamic domains such as noip.org (MS famously sinkholed them taking down millions of legit hosts!) But you can't as readily come up with IP addresses. I like this approach because the IP owner is always in a position to force remediation of the C2 server or infected host, they can ban the user or work with them to remediate the infection after confirming, they can request removal from the sinkhole. Most malware operators have no more than a handful active C2 IP addresses but from experience, I see them use dozens of domains,sometimes from different malware campaigns pointing to the few few IP addresses in their control. I am sure this has challenges but it is a cleaner way of doing it and focuses remediation on the C2. If this approach was taken, OP's IP would have been accidentally sinkholed, her webhost would contact her about it, she would show proof that the server has not hosted malicious content and work with them to lift the sinkhole. Meanwhile,the site can be moved to a different host (if it takes too long) and IP address, since the domain is not being sinkholed it would just work. Malware researchers and law enforcement can see if infected hosts continue to communicate with the new IP or if the new IP responds to C2 initial traffic to decide if it should continue to be sinkholed (costing OP hosting money if it was an attacker, it might cost them money and access to compromised hosts).