that's a good one not perfect for sure, hackers would just start buying domains earlier but still...

Yeah, but there is a takedown process when a spam site is detected (the server provider can shut off access, etc), so it is a game that is somewhat winnable.