Remote Access Tools category
Remote desktop, remote support and remote management domains. They are essential for IT teams, and they are also a route for scams, attacker persistence and filter bypass.
Remote Access Tools is one of the 59 categories in our web filtering categories list, built so you can allow the tools you approve and block the rest.
What the Remote Access Tools category includes
A domain carries this label when its job is to let someone see and control a computer from another place.
That covers the product sites people download from and the domains the tools use while running.
Remote desktop products
Websites and download pages for software that gives full control of another computer's screen, keyboard and mouse.
Remote support services
Help desk tools where a technician joins a user's session after the user enters a code or accepts a prompt.
Session join portals
Short web pages that ask for a session code and start a download or a browser session. Scammers send people to these.
RMM platforms
Remote monitoring and management services that MSPs and IT teams use to patch, script and control many devices.
Relay and broker domains
Hosts that tools contact to find each other and pass the session through firewalls. These matter most for blocking.
Browser-based remote desktops
Services that run a remote desktop session inside a browser tab, with no install needed.
Web terminals and shells
Services that give command-line access to remote machines through the browser.
Access your home PC services
Consumer tools for reaching a personal computer from anywhere. These are the main school bypass route.
Mobile device control
Services for viewing or controlling phones and tablets remotely, outside of formal device management.
Unattended access agents
Domains for always-on agents that allow connections without anyone present at the machine.
Wake and power tools
Services that wake, restart or power-manage machines remotely, often bundled with remote access.
Tool documentation and portals
Account consoles and help centres for remote access products, which share infrastructure with the tool.
Legitimate use and abuse: two sides of the same tool
The same software that helps an IT team fix a laptop also helps a scammer empty a bank account. Policy is about who is allowed to use which tool, not about the tool being good or bad.
Legitimate use
- IT help desks fixing staff devices without a site visit
- MSPs managing hundreds of client machines
- Engineers reaching servers and lab machines
- Teachers supporting students' devices during class
- Families helping relatives with a computer problem
- Vendors supporting equipment they have installed
Abuse patterns
- Tech support and refund scams that talk victims into installing a tool
- Attackers installing a legitimate tool to keep access after a break-in
- Students reaching an unfiltered home computer from school
- Staff moving data outside approved channels
- Unapproved tools installed by third parties without IT knowing
- Fake download pages that bundle malware with a known tool name
Security agencies have published advisories about attackers using legitimate remote management software, because it looks like normal IT activity. Check the current guidance from your national cyber security agency.
How remote access becomes a filter bypass
This is why school and enterprise filters treat the category as a security issue. Each stage shows where a category block breaks the chain.
Set up at home
A user installs a remote tool on a home or personal computer that has no filter.
Not visible to the school or office networkConnect from the managed device
On a filtered device, the user opens the tool's web portal or app and reaches the relay domains.
Blocked when the category is blockedBrowse inside the session
All browsing happens on the home computer. The network only sees a stream of screen images.
Web content filters cannot see these sitesPolicy is bypassed
Blocked categories, safe search and logging no longer apply to what the user does.
Prevented at stage twoThe same logic applies to VPN, proxy and anonymizer sites. Blocking both categories together closes the two most common filter bypass routes.
Exclusions and neighbouring categories
Several categories sit close to remote access. Knowing the boundary helps avoid blocking meeting tools or code hosts by mistake.
| Site or service | Category | Why it is not Remote Access Tools |
|---|---|---|
| VPN services and web proxies | VPN / Proxy / Anonymizers | They relay network traffic rather than show another computer's screen. |
| Video meetings with screen sharing | Web-based Applications or Webinars/E-learning | Showing a screen to others is not taking control of a machine. Some meeting tools add remote control, which can earn a second label. |
| Code hosting and developer platforms | Developer Tools / Code Hosting | Storing and reviewing code is not remote control of a device. |
| Cloud file sync and sharing | Cloud Storage or File Sharing | Files move, but nobody controls the other machine. |
| Remote access trojans and their servers | Malware / Phishing / Suspicious | Malicious control software is a security threat, not a tool category. |
| Cloud hosting providers | CDN / Hosting / Infrastructure | Server hosting brands are infrastructure, even though admins reach servers remotely. |
| Device management for schools and companies | Web-based Applications | Policy and inventory consoles that do not offer screen control. |
| Blogs reviewing remote access software | Computers & Technology | Writing about a tool is not the tool itself. |
Typical remote access site types and labels
How common remote access domains usually appear in the file, with the most descriptive label first.
| Site | Main label | Second label | Note |
|---|---|---|---|
| Remote desktop vendor homepage | Remote Access Tools | Freeware/Software | Downloads and product pages. |
| Session code entry page | Remote Access Tools | None | A frequent scam landing point. |
| Relay and broker hosts | Remote Access Tools | CDN / Hosting / Infrastructure | Needed for the tool to connect. |
| RMM console for MSPs | Remote Access Tools | Web-based Applications | Allow only for approved providers. |
| Browser remote desktop service | Remote Access Tools | Web-based Applications | No install, same control. |
| Tunnelling service for exposing local apps | Remote Access Tools | VPN / Proxy / Anonymizers | Can open paths into a network. |
| Meeting tool with remote control | Web-based Applications | Remote Access Tools | Meetings dominate, control is a feature. |
| Fake download page for a known tool | Malware / Phishing / Suspicious | Remote Access Tools | Security ranks first. |
| Tech support scam site | Malware / Phishing / Suspicious | Remote Access Tools | Pushes victims to install a tool. |
| Vendor help centre | Remote Access Tools | Computers & Technology | Shares the tool's domain family. |
Policy table: schools, businesses, guest Wi-Fi, parental control
Remote Access Tools is not one of the CIPA content categories, but it can defeat the filtering CIPA requires. Most policies block it and allow named exceptions.
| Setting | Common default | Reasoning | Exceptions |
|---|---|---|---|
| Schools and libraries (CIPA) | Block | A remote session to an unfiltered computer bypasses the technology protection measure on school devices. | Allow the district IT support tool, ideally only for staff devices. |
| Businesses | Block plus allow list | Unapproved tools are a known attacker foothold and a data loss route. | The company's own support and RMM tools, plus named vendors. |
| MSP-managed clients | Allow approved only | Only the MSP's chosen platform should be able to reach client devices. | Time-bound access for vendors supporting specific equipment. |
| Guest Wi-Fi | Block or limit | Guests rarely need it, and the network owner may not want to carry unknown remote sessions. | Contractors who need to reach their own systems can use a separate network. |
| Parental control | Block for children | Protects against scam calls and stops children reaching unfiltered devices. | A parent-approved support tool for family help. |
School teams can read how this fits with other controls on the K-12 school web filtering page.
Risk by type of remote access domain
Not every remote access domain carries the same risk. The bars show how much each type usually matters for bypass and abuse.
Consumer home access
The main filter bypass route in schools and a common scam route for home users.
Session join portals
Where scam callers send victims. Blocking stops the first step.
Unknown RMM platforms
Attackers favour tools a company does not use, so their traffic stands out less than malware.
Browser remote desktops
No install needed, so they work on locked-down devices.
Tunnelling services
Useful to developers but can expose internal services to the internet.
Approved support tool
Low risk when tied to your own accounts and logged by IT.
Multi-category cases
A domain can carry several categories ranked by how much of the site they describe. In this category, ranking decides whether a block applies.
Remote access with built-in tunnel
Some tools also route web traffic. Both bypass labels apply, so either rule blocks it.
Help desk suite with remote control
Ticketing comes first. A business can allow the suite and still block standalone remote tools.
Lookalike download site
A copy of a known vendor page that serves a tampered installer. Security ranks first.
Cloud development environment
Browser workspaces with shell access to remote machines. Engineering teams usually need an exception.
Virtual desktop gateway
A company's own gateway to hosted desktops. Allow your own gateway by domain, block others by category.
Free remote desktop download site
Popular with students and scammers alike. Both labels give schools two ways to block it.
How vendors use the Remote Access Tools category
Security product teams rely on this label in several ways, from school bypass control to spotting attacker tools.
Bypass prevention in school filters
School filter makers block the category by default so remote sessions cannot undo their content rules.
Shadow tool detection
Secure web gateways and DNS filters alert when a device contacts a remote tool the company does not use.
Allow list enforcement
Firewalls allow one approved support platform by domain and block the rest by category.
Scam protection for consumers
Parental control and security apps block session join pages to stop scam calls from turning into account takeover.
MSP client protection
MSP platforms block other RMM tools on client networks so only the provider's own tool can reach devices.
Incident investigation
Security teams search logs for the category to find when an unapproved tool first appeared on a network.
Licensed customers can receive this category as DNS RPZ, hosts files or firewall external dynamic lists. See OEM licensing for embedding it in a product.
Rollout checklist for blocking remote access tools
Blocking this category without preparation can cut off your own help desk. Work through these steps first.
- List every remote tool your IT team and vendors actually use
- Allow those tools by domain before blocking the category
- Include relay and broker domains for each approved tool
- Block VPN / Proxy / Anonymizers at the same time
- Add application control for installed clients where available
- Turn on alerts for blocked attempts, not only silent blocks
- Test a support session from a managed device after the change
- Give vendors a separate, time-bound access route
- Check uncertain domains with the domain lookup tool
- Review blocked attempts weekly for signs of scams or intrusion
Why fresh data matters for this category
Remote access domains change often, and abusers move fast. These outputs keep the category current.
Daily new domains
About 300,000 newly registered domains are categorized every day and delivered as delta files.
Rechecks
New domains are checked again after a week and after a month, when many scam pages switch on.
Monthly refresh
All other domains are refreshed monthly, so tools that rename or add relays are picked up.
120 million domains
The full database covers the long tail of small tools as well as the large vendors.
On-premise files
CSV, Parquet or JSON that run inside your systems, including air-gapped networks.
Lookup API
Included with licences for real-time checks. See the web filtering database.
Remote Access Tools category FAQ
What is the Remote Access Tools category?
It covers domains used to control a computer from somewhere else: remote desktop products, remote support and screen control services, remote monitoring and management platforms, and the portals and relay domains these tools connect through.
Why would a school block remote access tools?
A student can connect from a school device to an unfiltered computer at home and browse from there. The filter only sees the remote session, not the sites visited, so the tool works as a filter bypass.
Is Remote Access Tools the same as VPN / Proxy / Anonymizers?
No. A VPN or proxy relays web traffic. A remote access tool sends the screen and keyboard of another computer. Both can bypass filters, so many policies treat them together, but they are separate categories.
How are remote access tools used in scams?
In tech support and refund scams, callers persuade victims to install a remote tool and then take control of their computer or bank sessions. Blocking unapproved tools on managed networks removes that route.
Should businesses block the whole category?
Many block it by default and allow only the tools their IT team approves. Unapproved remote tools are a known way for attackers to keep access to a network.
Which firewall category matches Remote Access Tools?
Many vendors have a remote access category, sometimes grouped with proxy avoidance or with business applications. Check the current list in your console.
Are browser-based remote desktops included?
Yes. Web portals that start a remote desktop or remote support session in the browser carry this category, because they give the same control as an installed tool.
License the database
Remote Access Tools, VPN / Proxy / Anonymizers and 57 other categories in one file, with daily new domains, for your firewall, DNS filter or school filter. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.