So to distribute malware, I can buy a domain, set up a thousand subdomains, but only put malware on one of them. Then when that gets found I can move the malwar

So to distribute malware, I can buy a domain, set up a thousand subdomains, but only put malware on one of them. Then when that gets found I can move the malware to another, and so on, always being able to trivially work around blocking? At least when done at the domain level there's a cost involved for getting a new domain, which disincentivises the creation of many malware hosting domains.