I'm afraid a blocklist won't be enough. As anyone can just spin up an instance or move their existing one to a domain that isn't in the blocklist yet, a centralized whitelist will be the safer solution.