I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody remembers the specifications for how these lists were made/compiled. The list contains entries that are whole domains, e.g. foo.com, but it also contains many entries where the domain is the same but the subdomains are different, e.g. abc.bar.com, xyz.bar.com, and so on.
This caused us to think: are there reasons for blacklisting some subdomains of a domain but not the whole domain? This is an important question for us because it will affect how we design the list-checking logic: does the entire query need to match an entire entry in the list to be marked as blacklisted? Or does only the registered domain (SLD.TLD) need to match the registered domain of any entry in the list?
We tried to find literature on this but it was to no avail.