Just use a directory instead of a sub-domain and then block that directory... that's the easiest way.

I respectfully disagree. I know they don't necessarily pass loads of link juice but some of the paid directories don't have all the millions of spammy links to spammy sites in... because they're paid. Some are very, very cheap too. I know most are rubbish and not worth squat but there's still lots which are cheap and do pass link juice which far outweighs the cost.

Also the paid ones add you much faster... and if you want a diverse backlink profile it's worth getting a bunch of directories in there as well as your other link types... rely on the free ones and you could be waiting forever for that.

I have seen stuff like that in the SERP's but the only experience I have of getting hacked is a bit different. I worked in-house for a large travel corporation a couple of years ago and whilst the company's site was fine, their very popular blog wasn't. I just started there and looked at the source code of the blog (for some reason nobody was ever checking that) and found that there were hundreds of links to porn and poker sites hidden by CSS. It was all down to the fact that the blog was on Wordpress and hadn't been updated for a while.

Other than that, we've had sites we host hacked a few times, from hidden links to malware on the sites which of course produced warnings in the browsers. Again, all down to not keeping up with security patches and other updates. I learnt some lessons there.

And vice versa though? Could you end up with more traffic mistaking you for your larger competitor?