Welcome to the Q&A Forum

It sounds like you got a hold of the problem. Verify the subdomains in WMT Block the CDN subdomains with robots.txt Request site removal in WMT for the subdomains make the canonicals absolute Keep the blocked subdomains in WMT, when you log in you will see a message by the subdomains saying "Critical issue with your site" which is just telling you that the site is blocked.. I like to keep it in there so I can see it's still blocked.

Yes, you assumptions are correct. I'm concerned with similar aliases, typo domains, etc. So the best case scenario is doing at the hosting level. What if that is not an option, and I have to do 301 redirects from the registrar level? Next best option?