URL Category Data for Mobile Carriers
Mobile operators carry a huge share of everyday browsing, and subscribers increasingly expect the network to help keep them safe. Families want controls per line, businesses want policy for their fleets, and the operator wants to understand what drives traffic.
This guide is for product and network teams at mobile operators and MVNOs, and for the vendors who build their protection and analytics platforms. It covers where URL category data plugs in, which categories matter, and how to deliver data at carrier scale.
Family plan: line settings
Where URL category data plugs into a mobile operator
Category data serves several teams inside an operator at once. Each use draws on the same database, so one licence and one update job can support many services.
Network security add-on
A paid or bundled service that blocks phishing, malware and scam sites for every device on a line, with no app needed.
Family controls per line
Parents choose categories to block or schedule for each child's line, managed from the operator's app.
Business mobile policy
Company fleets get acceptable use and security policies by category across all employee lines.
IoT and machine lines
Connected devices should reach a few services only. Category blocks stop compromised devices calling out to risky sites.
Customer care tools
When a subscriber asks why a site was blocked, care agents see the category and can explain or adjust settings.
Aggregated analytics
Traffic by category across the network, a region or a plan helps with capacity, product and partnership decisions.
Where the lookup happens in the network
Mobile traffic passes several points where a category check can run. Most operators enforce at the resolver or a policy function in the data path, and feed analytics from aggregated records.
Which categories matter for each mobile service
Different services draw on different parts of the 59 web filtering categories. The table shows typical defaults, which operators adjust to local law, culture and their own product design; definitions are on the category list.
| Category | Security add-on | Family line | Business line | IoT line |
|---|---|---|---|---|
| Malware / Phishing / Suspicious | Block | Block | Block | Block |
| Cryptomining | Block | Block | Block | Block |
| Parked / For-Sale Domains | Warn | Block | Warn | Block |
| Adult | Not part of it | Block | Company choice | Block |
| Gambling, Dating | Not part of it | Block | Company choice | Block |
| Violence, Weapons, Illegal Drugs, Hate/Discrimination | Not part of it | Block | Company choice | Block |
| VPN / Proxy / Anonymizers | Not part of it | Block | Company choice | Block |
| Social Networking | Not part of it | Schedule | Allow | Block |
| AI / LLM Tools | Not part of it | Parent choice | Approved list | Block |
| Streaming Media | Not part of it | Schedule | Allow | Block |
Product shapes operators build on category data
Operators package category based services in a few common ways. Each shape needs the same data but different settings, app screens and care processes.
Safe browsing for all
- Phishing and malware blocking on every line
- Bundled with plans or sold as an add-on
- Simple opt-out
- Builds trust in the brand
Family pack
- Age based category presets
- Schedules for social and streaming
- Managed in the operator app
- Pairs with device app controls
Business shield
- Fleet-wide category policy
- Reports by category for admins
- Approved AI and file hosting lists
- Sold with business plans
IoT lock-down
- Only named services allowed
- Risky categories blocked by default
- Alerts on unusual destinations
- Per-customer device groups
Privacy-aware traffic analytics
Category analytics can answer useful business questions without building browsing profiles of people. The design choice that matters is to aggregate early and keep only counts.
Questions analytics can answer
- Which site types drive peak load in each region
- How streaming and social traffic shift by time of day
- How many phishing visits the security add-on blocked this month
- Which categories grow fastest, such as AI tools
- Which partnerships or bundles would interest subscribers
Design rules that protect subscribers
- Aggregate by category, region and time before storage
- Keep no per-subscriber browsing history for analytics
- Apply minimum group sizes before reporting
- Follow local privacy and telecom rules and subscriber terms
- Keep security blocking logs separate, short-lived and access controlled
Example: share of blocked requests by category on a security add-on
The subscriber experience: warning pages, overrides and care
A network service lives or dies on how it feels to subscribers. Categories make every block explainable, which keeps complaints down and trust up.
Clear warning pages
Name the category in plain words, such as "This site was reported for phishing", and show the operator brand so people know the page is genuine.
Fair overrides
Let adults continue past a warning for low-risk categories, and keep hard blocks for phishing and malware.
Parent approval
For family lines, a child's request to open a blocked category can go to the parent's app for a quick yes or no.
Report a mistake
A simple link to report a wrong category feeds the operator's review queue and its exception list.
Local language
Translate category names and warning text for every market, since one group may serve several languages.
Monthly summaries
A short message such as "We blocked 4 scam sites on your lines this month" shows subscribers the value they pay for.
MVNOs, roaming and operator groups
Not every mobile brand runs its own core network, and not every subscriber stays at home. The data model has to work across these setups.
MVNOs and sub-brands
- Category services can run on the host network's resolvers or on the MVNO's own
- Each brand keeps its own presets, warning pages and app screens
- One database can serve several brands under a group-wide licence
- Care tools show the category whatever the brand
Roaming and travel
- Traffic that breaks out locally abroad may skip the home resolver
- An operator app with on-device checks keeps protection while roaming
- Warning pages should work in the subscriber's language, not the visited country's
- Rules on filtering differ by country, so check what applies where traffic is handled
Common pitfalls for operator services
Operator teams launching category services meet a familiar set of problems. Planning for them early saves a rough first month in customer care.
Over-blocking
- Blocking whole shared platforms
- Use host level lookups
- Keep hard blocks for real threats
Stale data
- Monthly loads miss scam waves
- Apply daily deltas everywhere
- Monitor delta age per cluster
Silent blocks
- Pages that just fail to load
- Always show a warning page
- Name the category clearly
Privacy gaps
- Analytics that keep history
- Aggregate before storage
- Separate security logs
Delivery at carrier scale
A mobile network makes enormous numbers of DNS lookups every second. Category checks must run locally in the operator's systems, with the API used only for care tools and gaps; file formats are described on the web filtering database page.
Local index in resolvers
The database loaded into each resolver cluster, so lookups never leave the network.
Export formats
DNS RPZ, hosts files and other blocklist formats for platforms that expect lists.
Analytics files
CSV, Parquet or JSON in the data warehouse for aggregated reporting.
Lookup API
Included with licences, for care tools and subscriber apps. See the API documentation.
Freshness and coverage
Scam campaigns sent by text message often use domains registered days or hours before. A security add-on is only as good as its newest data, so the daily stream comes first.
newly registered domains categorized every day, as delta files
rechecks of new domains as sites add content
refresh of all other domains
categorized domains; the top 20 million cover 99.99% of web traffic and usage
Examples from mobile networks
These scenarios show category data at work in operator services. They describe common patterns, not any single network.
The parcel scam wave
A wave of fake delivery texts points to dozens of new domains. They arrive in the morning delta as phishing, and subscribers with the add-on see a warning page instead of a payment form.
A first phone
A parent sets up a child's line with the youngest preset. Adult, gambling and anonymizer categories are blocked, and social networks pause at bedtime.
A sales fleet
A company blocks file sharing and anonymizers on 800 sales phones and receives a monthly report of blocked attempts by category.
Smart meters calling out
A batch of connected meters starts contacting a cryptomining pool. The IoT policy blocks the category and alerts the customer about a likely compromise.
"Why is this blocked?"
A subscriber calls about a blocked site. The agent sees it was categorized as Gambling under the family preset and walks the parent through changing it.
Planning for AI traffic
Aggregated counts show AI tool traffic growing fast in student-heavy areas, which informs plan design and capacity planning.
A youth brand launch
A youth-focused MVNO launches with safe browsing on every line and a stricter preset for under-16 accounts. It runs on the host network's resolvers with its own warning page design.
Five markets, one source
A group with networks in five countries loads one database in each, adjusting family presets and legal requirements per market while sharing one update pipeline.
Rollout plan for an operator
Operators usually move in phases, starting with security for everyone and adding paid controls once the platform is proven.
Load and test
Load the database into a resolver cluster in a lab and replay real query volumes to check speed and memory.
Security for all
Turn on phishing and malware blocking with a clear warning page and simple opt-out.
Family controls
Add per-line category presets and schedules in the operator app.
Business and IoT
Offer fleet policies and lock-down profiles with reports for customer admins.
Care and analytics
Show categories in care tools and build aggregated category dashboards for planning.
Group rollout
Repeat in other national networks under a group-wide licence, adjusting presets to local rules.
What to check before licensing category data
Operator procurement teams usually compare data suppliers on a short list of points. These are the ones that matter most for mobile services.
Runs in your network
- Local files for resolvers
- No per-query outside calls
- Subscriber traffic stays with you
Speed of new data
- Daily new domain deltas
- Rechecks after a week and a month
- Monthly full refresh
Family-ready categories
- Clear adult, gambling and drug labels
- Anonymizer and VPN coverage
- Separate AI tool categories
Licence fit
- OEM terms for subscriber services
- Group-wide terms for many markets
- Measured accuracy reports
Mobile carrier FAQ
How do mobile carriers use URL category data?
Mostly in network security add-ons, family plans with controls per line, policies for business and IoT lines, and aggregated analytics of which site types drive traffic.
Where does the category lookup happen in a mobile network?
Usually in the operator's DNS resolvers or in a policy function in the data path. Both need a local copy of the data, because lookups must be fast and subscriber traffic should stay in the operator's systems.
Can category data be used for network analytics without tracking people?
Yes, analytics can count traffic by category across the network, a region or a plan, without per-subscriber browsing records. Follow local privacy and telecom rules and your subscriber terms.
Which categories matter for subscriber protection?
Malware / Phishing / Suspicious is the core, with Parked / For-Sale Domains, Cryptomining and URL Shorteners as useful signals. Family plans add Adult, Gambling, Dating, Violence, Illegal Drugs, Weapons, Hate/Discrimination and VPN / Proxy / Anonymizers.
How fresh is the data?
About 300,000 newly registered domains are categorized every day as daily delta files. Each is checked again after a week and after a month, and all other domains are refreshed monthly.
Does encrypted DNS affect network filtering?
Yes, devices or apps that use their own encrypted DNS can bypass the operator's resolver. Operators combine resolver filtering with other enforcement points and on-device apps.
Which licence fits a mobile operator?
If categories power services sold to subscribers or businesses, an OEM licence fits. Group-wide licences suit operator groups in several countries.
Can the data help with legal blocking orders?
Category data is not a substitute for lists issued by courts or authorities, which must be applied exactly as given. It can help operators understand and report on what those lists contain.
Can an MVNO use the data if it does not run its own core network?
Yes, the service can run on the host network's resolvers or on resolvers the MVNO operates itself, with the MVNO's own presets and warning pages. A group-wide licence can cover several brands.
How should operators handle a subscriber who reports a wrong category?
Give subscribers a simple report link on the warning page and route reports to a review queue. The operator can add a local exception at once while the domain is reviewed.
Does the data cover AI chatbots and AI apps?
Yes. The AI tools set covers 11,800+ AI-tool domains in 18 categories and 165 subcategories, which lets family plans and business lines treat AI chatbots, image generators and other AI services separately.
Protect every line with current category data
Tell us about your network, the services you plan and the markets you serve. We will suggest the data layout and licence that fit.
License the database OEM licensing