Process and analysis
What is Blocklist?
A list of addresses, domains or hashes a tool refuses automatically. Useful and cheap, and near the bottom of the Pyramid of Pain.
A blocklist is a list of IP addresses, domains, URLs or file hashes that a security control refuses automatically. Firewalls, proxies, mail gateways and endpoint tools all consume them.
Blocklists are cheap and fast, which makes them useful against commodity threats. Their weakness is that the entries are easy for an attacker to change. A new domain or a recompiled file walks straight past, which is why blocklists sit near the bottom of the Pyramid of Pain.