Cybersecurity Web Filtering | content classification & unsafe content Blocking API

content classification for Security Products

Cybersecurity product vendors need comprehensive, accurate, and constantly updated domain classification data to power their content filtering and content filtering capabilities. Whether you are building a next-generation firewall, a secure web gateway, an endpoint protection platform, or a DNS security solution, the quality of your URL classification directly determines your product's ability to detect and block web-based content risks.

Building and maintaining an in-house domain classification system requires enormous investment. Web crawling infrastructure, machine learning models, content risk research teams, and global sensor networks represent millions of dollars in annual operating costs. Even well-funded security vendors struggle to maintain classification coverage across the 120 million active domains on the internet while simultaneously keeping pace with the thousands of new malicious domains registered daily.

Our web filtering database provides the classification intelligence that security product vendors need to deliver comprehensive content filtering. With 120 million domains classified across 58 categories, including dedicated content risk categories for unsafe content, command-and-control, exploit kits, and cryptomining, your products gain immediate access to classification data that would take years and millions of dollars to build independently. Vendors serving the education sector, where schools are among the most targeted institutions for cyberattacks, can deliver cloud-based web filtering that works on any school network from the same classification source.

Data for security builders

Give your detection stack a category on every hostname

Firewall, gateway, DNS and SIEM teams license our web filtering database instead of running a crawler of their own. Each domain arrives with several categories where a site fits more than one, which you can turn into a verdict, a label or a risk score.

Load it as CSV or JSON files, call the real-time API, or run the offline database inside your own systems.
New domains are categorized every day, so a fresh hostname rarely reaches a customer unlabeled.
Filter, firewall, DNS and security vendors already build on the same records.

Domain records with web filtering categories for a security product

web filtering categories to build verdicts from

~300,000

new domains labeled every single day

99.99%

of the active internet has a category

Review the database options Read about OEM licensing Test a hostname from your logs

Security Product Integration

Purpose-built for embedding into security products across every deployment model

Firewall & UTM Integration

Embed our classification database into next-generation firewalls and unified content risk management appliances. Our bulk data feed integrates with common firewall platforms to enable policy-based URL filtering without proxying traffic. Classify domains during DNS resolution or at the HTTP layer to enforce granular web access policies alongside your existing firewall rule sets.

Secure Web Gateway

Power the URL categorization engine in your secure web gateway product. Our 58-category taxonomy covers the full spectrum from content risk categories like unsafe content to content categories like social media and streaming. Customers can build granular web access policies that simultaneously address web-based risks and acceptable-use requirements using a single classification source.

Endpoint Protection

Add web filtering capabilities to your endpoint protection platform. Our lightweight API enables real-time URL classification at the endpoint level, blocking connections to malicious domains before any content is downloaded. Protect endpoints from drive-by downloads, malicious redirects, and social engineering attacks that bypass network-level controls when users work from untrusted networks.

SIEM & SOAR Enrichment

Enrich security events with domain classification context. When your SIEM ingests DNS logs, proxy logs, or firewall events, our API adds category labels that help analysts distinguish routine web traffic from suspicious activity. SOAR playbooks can automatically query domain classifications to triage alerts, reducing mean time to detect and respond to web-based content risks.

content risk Category Coverage

Our content risk-focused categories go beyond simple unsafe content labels. We classify domains into specific content risk categories including restricted content distribution and credential harvesting, command-and-control infrastructure, exploit kits, cryptomining and cryptojacking, spam and scam operations, DGA-generated domains, newly registered domains, and parked domains commonly used as staging infrastructure for attacks.

Each content risk classification includes confidence scoring that reflects the strength of evidence supporting the categorization. High-confidence classifications are based on confirmed malicious activity observed by our sensor network. Medium-confidence classifications indicate strong classification indicators but without confirmed payload delivery. This granularity allows security products to apply different enforcement actions based on content risk certainty, blocking confirmed content risks outright while flagging suspicious domains for additional inspection.

unsafe content Domain Intelligence

unsafe content distribution and restricted content infrastructure evolve rapidly. content risk actors register thousands of new domains daily, use fast-flux DNS to rotate IP addresses, and leverage legitimate cloud services to host malicious content. Static blocklists become stale within hours. Effective protection requires a classification system that identifies malicious domains through behavioral analysis, infrastructure correlation, and machine learning models trained on current content risk data.

Our classification pipeline processes newly observed domains in near real time. When a domain is first seen in DNS traffic across our global sensor network, it enters our classification queue. Machine learning models analyze domain registration patterns, DNS infrastructure, hosting providers, SSL certificate characteristics, and content when available to generate initial classifications within minutes of first observation.

For restricted content specifically, our models detect the telltale patterns of credential-harvesting pages even before they appear on traditional restricted content feeds. Suspicious domain registrations that combine brand names with random strings, domains hosted on compromised infrastructure, and pages that request authentication credentials are flagged for immediate classification, giving your security products the ability to block restricted content attempts during the critical first hours before widespread reporting.

Hostname in the alert	Category stored
pastebin.com	Developer Tools / Code Hosting, Cloud Storage / File Hosting
bit.ly	URL Shorteners
no-ip.com	Remote Access Tools
mega.nz	Cloud Storage / File Hosting
github.com	Developer Tools / Code Hosting

High-Performance API Architecture

Security products operate under strict latency requirements. A firewall cannot add hundreds of milliseconds to every web request for URL classification. An endpoint agent cannot freeze while waiting for an API response. Security vendors need classification data that is available locally for microsecond-level lookups, with API fallback for domains not in the local cache.

Our architecture delivers classification data through multiple channels optimized for different security product requirements. Bulk data feeds provide the complete 90-million-domain database for local deployment on appliances and servers. Incremental update feeds deliver new and changed classifications every 15 minutes. Real-time API endpoints handle lookups for domains not found in the local database with median response times under 5 milliseconds.

For OEM integration, we provide the database in multiple formats compatible with common security platforms. RPZ zone files for DNS-based products, CSV and JSON feeds for firewall and proxy integration, and native SDKs for C, Python, Go, and Java that handle local database queries and API fallback transparently. Your engineering team can integrate our classification data into your product pipeline in days rather than months.

Cybersecurity Use Cases

How security product vendors and enterprise security teams leverage our classification intelligence

NGFW URL Filtering Engine

Power the URL filtering module in your next-generation firewall with our 90-million-domain classification database. Deploy as a local lookup table on the firewall appliance for wire-speed classification, with incremental updates every 15 minutes to keep content risk categories current. Support customer-configurable policies that combine content risk blocking with content filtering across all 58 categories.

DNS Security Service

Build a protective DNS service that blocks connections to malicious domains before any content is exchanged. Our database integrates directly with DNS resolver platforms to return NXDOMAIN or redirect responses for domains classified as unsafe content, or command-and-control. Deploy as a cloud DNS service or distribute to customer premises resolvers for enterprises that require on-network enforcement.

SOC Alert Enrichment

Reduce alert fatigue in security operations centers by enriching every domain-related alert with classification context. When an analyst investigates a suspicious connection, they immediately see whether the destination domain is classified as unsafe content, newly registered, or a legitimate business site. This context accelerates triage decisions and reduces the mean time from alert to resolution across all web-related security incidents.

content risk Hunting Enrichment

Empower content risk hunters with domain classification data that reveals patterns invisible in raw logs. Query historical classification changes to identify domains that shifted from benign to malicious categories. Correlate newly registered domain access with endpoint telemetry to discover compromised systems communicating with command-and-control infrastructure that traditional signature-based detection missed.

120M

Domains Classified

Content Categories

15min

classification feed Updates

<5ms

API Response Time

Build the classification yourself or license it

The comparison below covers what a security vendor takes on in each case.

Question	Own crawler and models	Our database
Coverage of active sites	Grows slowly as your crawl grows	120M+ categorized domains, 99.99% of the active internet
Category design	You define and maintain the taxonomy	58 web filtering categories, several per domain where a site fits more than one
New domains	Your team labels them as they appear	About 300,000 categorized every day
Where it runs	Your infrastructure	Inside your own systems, as files, API or offline database
Staffing	Researchers, crawler operations, review queues	Licensed data, your engineers focus on the product

Compare database plans See OEM terms

Web Filtering for Cybersecurity Products

We run the web filter for your library or school