I bet 30% of those hosts are don't resolve anymore I've seen some evidence of this. I periodically dig all the blocked domains and noticed that some of them c

I bet 30% of those hosts are don't resolve anymore I've seen some evidence of this. I periodically dig all the blocked domains and noticed that some of them come and go so I assume people cycle them in and out to evade blocking. A handful of the domains just change the A record so I just block the apex domain which makes it a little harder to keep the block lists optimized but does reduce the size a little. I should add that blocking the apex of some domains includes risk of dropping legit traffic but if I see more than {n} badware domains on the apex, I write it off as compromised or at very least poorly implemented and poorly secured.