Credential phishing
Fake sign-in pages for email, banking, cloud storage, delivery and payment services, built to collect passwords and codes.
BlockMalware and Phishing Domain List for DNS, Firewalls and Apps
If you block only one list, block this one. A malware and phishing domain list stops users and devices from reaching credential traps, malware downloads and scam sites, whatever app or link brought them there.
Below: what the list covers, how fast it changes, the formats it ships in, how to deploy it and how to deal with the false positives every security list produces.
Dailynew-domain delta files
~300,000new domains categorized a day
3 checksday one, one week, one month
59categories in the same file
What the phishing and malware list contains
In our taxonomy these domains sit in the Malware / Phishing / Suspicious category. The category groups several kinds of risk, so you can treat them as one list or split them by how sure you need to be.
Malware delivery
Domains serving malicious downloads, fake software updates, booby-trapped documents and drive-by pages.
BlockScam storefronts
Shops that take payment and never ship, fake investment platforms and prize or survey scams.
BlockBrand impersonation
Lookalike names that copy a known brand with swapped letters, extra words or a different extension.
Block or warnSupport scams
Pages that fake a virus alert and push a phone number or a remote access download.
BlockSuspicious
Domains with strong signs of abuse but no confirmed payload yet, such as freshly registered lookalikes.
Warn or blockFor the security team's view of the same data as a feed, with fields and delivery details, read the phishing and malware domain feed guide. Category pages: phishing domains and malicious domains.
Patterns behind phishing domains
Phishing domains are built to look right at a glance. These are the patterns that show up again and again, shown with placeholder names under the reserved .test suffix.
# lookalike patterns, placeholders only
examp1e-bank.test # letter swapped for a digit
example-bank-secure.test # brand plus a trust word
login-example-bank.test # action word in front
example-bank.test-verify.test # brand used as a subdomain
xn--exmple-cua.test # punycode lookalike
example-parcel-fee.test # delivery fee lure
- Character swaps. One letter replaced by a similar digit or letter, which readers skip over.
- Trust words. Brand names joined with words such as secure, verify, account or support.
- Subdomain tricks. The real brand name placed on the left of a domain the attacker owns.
- International characters. Letters from other alphabets that render like Latin ones.
- Seasonal lures. Tax, parcel, refund and holiday themes that spike at predictable times.
- Free hosting abuse. Pages on shared site builders, where the parent platform stays legitimate.
Pattern rules alone overblock, because real companies also register names with words like secure or support. Our category is assigned from what the site does, so a pattern raises suspicion but does not decide the label on its own.
How big is a malware and phishing blocklist?
This category behaves differently from content categories. It is smaller than Adult or Shopping at any moment, but it turns over much faster.
Live set
What is active now
Domains currently serving phishing, malware or scams. This is the part that must be blocked today.
History
What was active
Domains that went quiet. Many are dropped or parked, but some return in a later campaign.
Daily
What is new
Fresh entries arrive every day in the deltas, often clustered around one campaign.
Popular
What users hit
Even a phishing domain can appear among visited domains for a few days while a campaign runs.
Because the live set moves daily, we give exact counts to licence holders rather than print a figure that would age within the week. Full category exports fit easily on resolvers and most firewalls.
How the list is kept current
Phishing campaigns often run for hours or days, not months. A list that updates weekly is mostly protecting you against last week's attacks.
1
Registration
About 300,000 newly registered domains are categorized every day.
2
Daily delta
New and changed entries ship as daily files your systems fetch automatically.
3
Week one
New domains are checked again, since many arm their pages after launch.
4
Month one
A second recheck catches domains that went bad, or went quiet, later on.
5
Monthly refresh
All other domains are refreshed and accuracy is measured by manual validation.
Pair this list with blocking newly registered domains. Young domains carry a high share of phishing risk, and a short hold on them closes the gap before any label exists.
Block, warn or log: a decision table
Not every entry deserves the same action on every network. This table is a sensible default that most security teams adjust over time.
| Entry type | School or kids' device | Office staff | Servers and IoT | ISP default | Notes |
|---|---|---|---|---|---|
| Confirmed phishing | Block | Block | Block | Block | No reason to let anyone through |
| Malware delivery | Block | Block | Block and alert | Block | A hit from a server suggests a compromise |
| Scam storefront | Block | Block | Block | Block or warn | Some ISPs warn to avoid disputes |
| Brand lookalike | Block | Warn | Block | Warn | Warn pages let real businesses through |
| Suspicious, no payload | Block | Warn | Block | Log | Review hits weekly |
Treat a server hit as an incident. Servers and IoT devices rarely have a reason to open phishing or malware domains. A lookup from one usually means something on that machine is already wrong.
Formats for the phishing domain list
Licensed customers receive CSV, Parquet and JSON source files, plus enforcement exports on request. The blocklist formats guide shows every layout in full.
# firewall EDL, fetched daily over HTTPS
example-login-verify.test
*.example-login-verify.test
example-invoice-update.test
; RPZ, sinkhole to an internal page
example-parcel-fee.test A 192.0.2.20
*.example-parcel-fee.test A 192.0.2.20
- DNS RPZ for resolvers, with a sinkhole address so blocked lookups show up in your logs.
- Firewall EDL hosted on your own server, so rules update without a change window.
- Hosts and adblock style for small DNS boxes in branch offices and homes.
- CSV, Parquet and JSON for SIEM enrichment, email gateways and your own products.
- Lookup API for one-off checks from scripts, tickets and playbooks.
Sinkhole addresses in the examples are documentation addresses. Use an internal server that serves a warning page and logs the client.
How to deploy a malware and phishing blocklist
Deployment is mostly about coverage and visibility: every device should use the list, and every block should leave a trace you can act on.
1. Resolver first
Load the list on the resolver every device uses. It protects phones, printers and guests as well as managed laptops.
2. Close DNS bypass
Block outbound DNS to outside servers and keep browsers from switching to their own encrypted DNS.
3. Add the firewall
Load the same list as an EDL so connections by IP after a cached lookup are still caught.
4. Cover roaming devices
Laptops off the network need a device agent or a cloud resolver that uses the same data.
5. Send hits to the SIEM
Every block is a signal. Forward resolver and firewall logs and alert on repeat hits from one device.
6. Automate updates
Fetch the daily delta, check it is not empty, and alert if the job fails twice in a row.
Integrating into a security product? See threat intelligence integration and DNS filtering integration.
False positives on a security list
A wrongly blocked domain on a security list hurts more than on a content list, because users learn to ignore warnings. These are the cases to plan for.
Where false positives come from
- Compromised sites: a real business hacked for a few days
- Shared platforms: one bad page on a large site builder or file host
- Marketing redirects: email click trackers that look like lure links
- New brands: a startup whose name looks like a lookalike
- Cleaned-up domains: an old bad domain bought by a new owner
How to handle them
- Never put large shared platforms on a domain block; their bad pages need URL-level controls
- Use warn for suspicious entries on staff networks
- Keep a short allow list owned by the security team, with a reason per entry
- Check the domain in the domain lookup before changing a rule
- Report the domain to us so it goes back into review
Rechecks after a week and a month also clear domains that have been cleaned up, so entries do not stay blocked forever once a site is safe again.
After a click: using the list in incident response
A block is the start of the story, not the end. When the list stops a lookup, a short routine turns that event into a fixed problem.
1
Find the device
Match the resolver or firewall log entry to a device and, where possible, a user.
2
Find the source
Check mail, chat and browser history for the link or file that triggered the lookup.
3
Check for spread
Search logs for other devices that looked up the same domain or its siblings.
4
Clean and reset
If a password was typed into a lure, reset it and review sign-in history.
5
Close the route
Purge the message, block the sender and tell users what the lure looked like.
Many campaigns use several domains at once. When one shows up in your logs, look at what else the same device queried in the minutes around it.
Who deploys a phishing and malware domain list
Almost every network operator uses this category, but each type of buyer cares about a different detail.
MSPs
One baseline for every client tenant, with block reports that show the value of the service each month. See MSP web filtering.
ISPs and telecoms
Network-wide protection for subscribers who never installed anything, served from the resolver.
Security vendors
Add category data to gateways, email filters and endpoint agents through an OEM licence.
Banks and regulated firms
Stop staff reaching lookalikes of their own brand and of their suppliers. See banking web filtering.
Schools
Students click fast and share links widely, so the block often happens before anyone reports the message.
App makers
Browsers, family apps and VPN apps ship the list as a built-in safe browsing layer.
Questions security teams ask before licensing
These are the concerns we hear most often from teams comparing a category list with what they already run.
"We already have threat feeds."
- Most feeds cover confirmed indicators only
- Category data adds the suspicious and lookalike layer, plus 58 content categories
- One file serves both security and acceptable use policies
"Will it break things?"
- Large shared platforms are not blocked as whole domains
- Suspicious entries can be set to warn instead of block
- Rechecks remove domains that have been cleaned up
"Can it run without internet access?"
- The data is delivered as files that run inside your own systems
- On-premise and air-gapped deployments are possible
- No lookup has to leave your network
"How do we know it is accurate?"
- Regular manual validations measure accuracy
- Licence holders can receive validation reports
- Disputed domains can be reported back for review
Lists that work well alongside this one
Attackers rarely rely on a single domain. These neighbouring lists close the routes that phishing and malware campaigns use most.
Test the list after rollout
- Query a placeholder entry you added to a staging copy, from a laptop and a phone
- Confirm the sinkhole page loads and the hit appears in your logs
- Point a device at an outside resolver and confirm it is refused
- Check that your mail, payroll and banking portals still open
- Repeat the checks on guest Wi-Fi and from a remote laptop
Watch these numbers each week
- Blocked lookups per day, split by network segment
- Devices with repeat hits, which often need a closer look
- Allow list size, which should stay short and owned
- Update job success, with an alert after two failures
Malware and phishing domain list FAQ
What is in a malware and phishing domain list?
Domains that host credential phishing pages, deliver malware, run scam storefronts or show strong signs of abuse, such as lookalike names of well-known brands. In our taxonomy they sit in the Malware / Phishing / Suspicious category.
How often should a phishing domain list update?
At least daily. Many phishing domains are used for a short campaign and then dropped, so a list that updates weekly misses most of the risk. Our new-domain deltas ship every day.
Is a domain list enough to stop phishing?
No single control is enough. A domain list stops users reaching known and suspicious domains from any device, but it works best alongside email filtering, multi-factor authentication, endpoint protection and user training.
What happens when a legitimate site is hacked and starts hosting phishing?
A compromised site is a hard case, because the domain is normally safe. Category data can flag it while it is abusive, and you can choose to warn instead of block for domains with a long clean history.
Should I block or warn on suspicious domains?
Block confirmed phishing and malware delivery outright. For domains marked suspicious without confirmed abuse, a warning page with a continue button is a reasonable middle ground on staff networks, while schools and kids' devices usually block.
Can I check a single domain before blocking it?
Yes. The domain lookup tool shows how a domain is categorized, and licensed customers can use the lookup API for checks inside their own systems.
Which format works best for a phishing blocklist on a firewall?
An external dynamic list hosted on your own HTTPS server. The firewall fetches it on a schedule, so daily updates arrive without manual work. Check your model's entry limit and subdomain matching rules first.
Does the list cover phishing pages on large shared platforms?
Whole shared platforms such as big site builders and file hosts are not blocked as domains, because that would break legitimate use for everyone. Phishing on those platforms needs URL-level controls in a proxy, browser protection or email filter.
Can I use the list inside an email security product?
Yes, under an OEM licence. Checking link domains against the category data at delivery time and again at click time is a common use, and the CSV, Parquet and JSON files load straight into a lookup table.
How much does a phishing and malware domain list cost?
The category is part of the full database licence, not a separate product. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
Block today's phishing, not last month's
License the categorized database with daily new-domain deltas, rechecks at one week and one month, and exports for resolvers, firewalls and SIEMs.