How would NO-IP detect C&C servers aliased to their subdomains, even if they connected to every single one of their subdomains daily -- they wouldn't know what

How would NO-IP detect C&C servers aliased to their subdomains, even if they connected to every single one of their subdomains daily -- they wouldn't know what ports to scan. By my, possibly naive thinking, they'd have to impose denial of service attacks on their own customers, constantly, and they would be easily thwarted by port knocking schemes. Probably their only recourse is to stop offering free service, and instead take payment, or require and verify customer IDs. I'm not sure there's a technical solution. Microsoft seems to be attacking their business model.