Would depend on the method. For the ones that are automated like opening a PDF - I doubt many attackers will bother blacklisting the domain in their DNS. But f

Would depend on the method. For the ones that are automated like opening a PDF - I doubt many attackers will bother blacklisting the domain in their DNS. But for the manual ones, like opening a link - it'd probably be better to host them at a much less suspicious sounding domain.