Dude is always using free domains from FreeDNS.
Regarding this:
https://blobfox.coffee/@Ember/115191088870619409
It's a FreeDNS domain. All of the ones they've used have been from there.
So how would you know?
Well, I made a blocklist for it. It updates daily, though I think I'm going to have to start updating it multiple times a day.
But if you search on this page, it's right there. ponyhost (dot) xyz.
My GoToSocial instance reads the blocklist every day and applies it. The issue is that it changes frequently (entries added/removed) so you're best off also having some kind of 'retractions' support if you do that.... unless you just want any domain that's on FreeDNS pre-seeded into your blocklist.
That's how I have over 25,000 blocks on this instance.