Domain blocklist

A domain blocklist is a curated list of domain names or URLs that are known or strongly suspected to be malicious, for example because they host phishing, malware or scams. Browsers, email security tools, DNS resolvers and firewalls use these lists to block connections or show a warning, which protects people even before the site itself is taken down.

How it works

Blocklist operators collect candidate URLs from reports, crawling, spam traps and partner feeds, verify them and publish the results. Different products consume them in different ways:

• Browser lists such as Google Safe Browsing and Microsoft SmartScreen show a warning page.
• Security vendors and industry groups, such as Netcraft and APWG, share phishing data with many products and partners.
• DNS-level blocking, often through Response Policy Zones, stops a resolver from answering for listed domains.
• National lists such as USOM's list of malicious links in Türkiye are used by organisations in their security tools.
• Email filters score or reject messages containing listed domains.

Listings are usually reviewed and expire or are removed once a site is cleaned up, so false positives can be corrected.

Example

As an illustration, a phishing page at examplepay-verify[.]com is submitted to several blocklists right after verification. Within hours, employees of companies using a filtering DNS service can no longer resolve the domain, and browser users see a warning. The registrar suspends the domain the next day, closing the remaining gap.

How to spot it

Ways to check whether a domain is already listed:

• open it in a browser that uses Safe Browsing or SmartScreen and look for a warning;
• check the blocklist operator's lookup tools where they exist;
• look at results from multi-engine URL scanners that aggregate many lists;
• see whether your own email or DNS security tools already block it.

What brands can do

Submit every confirmed phishing URL to the major blocklists as soon as it is verified, rather than waiting for the host. Provide clear evidence, because operators avoid listing on weak grounds. For high-risk names spotted early, such as newly registered domains using your brand, keep watching until there is content to report. Phishvoid submits verified URLs to blocklists alongside the phishing takedown; contact us to learn more.

Read more: The Phishing Site Takedown Process, Step by Step