How would blacklists be managed?
I’m not committed to one way of doing it. But I suspect it couldn’t be entirely automated. Sites would have to be inspected by humans to protect innocent sites from being blacklisted. If FFBs become a threat to them, spammers will try to give them a bad name by causing them to attack innocent victims. So blacklists should include ip addresses as well as domain names. Otherwise a spammer could switch the DNS record of a blacklisted site to point to an innocent victim. Anyone running a blacklist should assume, by default, that any url mentioned in a spam is the victim of a Joe job, and only blacklist sites when, after inspection, this is clearly not the case.
