Is it "legal"? It very much depends on jurisdiction, but the answer is broadly "yes". The issue (as illustrated by other blacklist cases like Spamhaus v. e360

Is it "legal"? It very much depends on jurisdiction, but the answer is broadly "yes". The issue (as illustrated by other blacklist cases like Spamhaus v. e360) is that you can be sued under various guises for setting up a blacklist (esp one that could impact revenue generation), and while you are likely to succeed you'll need to be able to fund the litigation long enough for a judgement.