Blocklist (Denylist)
A blocklist is a list of IPs, domains, URLs, or file hashes known to be malicious. Firewalls, DNS resolvers, and email gateways use blocklists to automatically block traffic from known bad actors. Blocklists must be kept current to remain effective.
Frequently Asked Questions
What is Blocklist (Denylist)?
A blocklist is a list of IPs, domains, URLs, or file hashes known to be malicious. Firewalls, DNS resolvers, and email gateways use blocklists to automatically block traffic from known bad actors. Blocklists must be kept current to remain effective.
How is Blocklist (Denylist) related to IP Reputation?
Blocklist (Denylist) and IP Reputation are both key concepts in threat intelligence. IP reputation is a score or classification indicating whether an IP address has been associated with malicious activity. Factors include appearance on blocklists, volume of spam sent, history of port scanning, C2 hosting, and abuse reports.
Related Terms
IP Reputation
IP reputation is a score or classification indicating whether an IP address has been associated with malicious activity. Factors include appearance on blocklists, volume of spam sent, history of port scanning, C2 hosting, and abuse reports.
Threat Feed
A threat feed is a structured, continuously updated stream of IOCs and threat data from a single source or aggregator. Security tools ingest threat feeds to keep blocklists and detection rules current. Examples include Spamhaus DROP, abuse.ch URLhaus, and CISA KEV.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.