Actually, there's ways you can make this scale. Your blacklist does a DNS lookup periodically, and modify the ISP routing table so that any IP that matches an entry in the blacklist is routed via the filter. So that means only IPs on the blacklist need the filtering logic.

A massive host using thousands of sites per IP is going to be slower, because somewhere on that host is bad stuff. But if you want to ensure you're fast, make sure you get your own IP for your host.

Not advocating for the plan, just that any technical problem, given enough resources, can be solved. We need to stop arguing that it's impossible in case someone makes it possible. We need to be arguing it's something we don't want.

Everyone knows that mattresses flollop in swamps. Not many of those in the Sahara!