Do you ban all the other free sub-domain services too? There's no reliable or honest statistic proving that eu.org is widely used for bad purposes.
And what about URL-shortener services, such as the one you work with? Should they be banned all together? They seem to be popular with spam and scammers...
We were getting spammed by hundreds of eu.org subdomains. We had no choice but to place a ban on the entire domain as banning a few just led to more popping up.
We ban as we see spam. Most free shorteners end up getting banned as there is no need to double shorten a url other than for double obfuscation which is usually shady.
And what about URL-shortener services, such as the one you work with? Should they be banned all together? They seem to be popular with spam and scammers...