Domain categorization for cybersecurity
Every alert, proxy log and DNS query contains domains. A category on each one tells an analyst what the destination is before they open a browser. This guide covers SOC enrichment, phishing triage, newly registered domains and threat hunting with category data.
What category data adds to security work
Threat feeds tell you about known bad indicators. Most domains in your logs are not on any feed, good or bad. Categories describe the rest, so analysts can separate normal business traffic from the destinations that need a second look.
Alert enrichment
Add category, country and popularity band to every domain in an alert. Analysts see context without switching tools.
Phishing triage
Reported emails and clicked links get a label at once. Brand new, uncategorized or suspicious domains rise to the top of the queue.
Newly registered domains
Apply a watch or restrict policy to fresh domains until they carry a category, then let ordinary sites through.
Threat hunting
Search logs for rare categories, such as remote access tools or anonymizers, on machines that should never use them.
Shadow IT discovery
Find unsanctioned cloud storage, file sharing and AI tools in proxy and DNS logs, grouped by category.
Policy and filtering
Turn categories into DNS, proxy or firewall policy, so blocking follows what a site is rather than a hand kept list.
Categories security teams rely on
Of the 59 web filtering categories in our taxonomy, these are the ones that come up most in security work. The level shows how much attention a hit usually deserves, not a verdict.
| Category | Why it matters | Typical attention |
|---|---|---|
| Malware / Phishing / Suspicious | Sites known or judged to host malicious content or credential theft. | High |
| Parked / For-Sale Domains | Placeholder names that may redirect or be reused for attacks. | Medium |
| VPN / Proxy / Anonymizers | Tools that can bypass monitoring and policy. | High on managed devices |
| Remote Access Tools | Legitimate tools often abused for unauthorized access and support scams. | High if unexpected |
| URL Shorteners | Hide the final destination of a link. | Medium |
| File Sharing/P2P | Data leaving the network and unwanted downloads. | Medium |
| Cloud Storage / File Hosting | Used for exfiltration and for hosting phishing kits on trusted names. | Context dependent |
| AI / LLM Tools | Data shared with outside services, often without approval. | Policy dependent |
| Cryptocurrency | Payment destinations and lures in some scams. | Context dependent |
| CDN / Hosting / Infrastructure | Shared infrastructure that explains much background traffic. | Low, explains noise |
Coverage of selected risk categories
A few counts from our database show how many domains sit in categories that matter for policy. Counts move every month as domains are added, change and expire.
A phishing triage playbook with categories
A user reports a suspicious email. Here is how category data fits into each step of a typical triage, without replacing the analyst's judgement.
Pull every domain from the message
Sender domain, reply-to, link targets, image hosts and any domains inside attachments. Normalize to registered domains.
Look up categories in bulk
A local file lookup returns category, country and popularity band for each domain in milliseconds, with no outside call needed.
Separate the known from the unknown
Popular business, banking and infrastructure domains are usually there for legitimate reasons. Focus on what is new, rare or uncategorized.
Raise the risky labels
Malware, parked, URL shortener and newly registered labels move the case up. A banking brand in the text with a link to an uncategorized new name is a classic pattern.
Block, hunt and close
Block confirmed bad domains, search logs for other users who visited them, and record the outcome so similar reports close faster.
Remember: a legitimate category does not clear a link. Attackers host lures on trusted cloud storage, form builders and compromised sites. Categories speed up triage; they do not replace inspection of the actual URL and content.
Newly registered domains
Fresh domains are a favourite tool for phishing and malware campaigns because they have no history and no reputation yet. They are also where legitimate new businesses start, so blanket blocking forever is not the answer.
Newly registered domains categorized and delivered as daily delta files.
Each new domain is checked again, because many sites add content after launch.
A further check catches sites that changed purpose or switched from parked to active.
The domain joins the full database and its regular monthly refresh.
Common policies for new domains
- Watch: log and alert on visits during the first days or weeks.
- Restrict: block new domains on high risk groups such as finance staff.
- Isolate: open new domains only in a remote browser.
- Release: allow once the domain carries an ordinary category.
Where to read more
- The newly registered domains list explains the daily feed.
- Our parked domain detection guide covers names that go dormant.
- Malware and phishing protection shows feed based uses.
- Coverage and freshness explains refresh cycles.
Threat hunting queries built on categories
Categories make hunting questions easy to express. These examples run on DNS or proxy logs joined to the category file. Adjust the thresholds to your environment.
| Hunt | Logic | What it can reveal |
|---|---|---|
| Rare remote access | Remote Access Tools visited by hosts outside the IT team. | Support scams or unauthorized access. |
| Anonymizer use | VPN / Proxy / Anonymizers on managed devices. | Policy bypass or hidden data transfer. |
| Fresh and unpopular | Domains registered in the last 30 days with no popularity band. | Early phishing and command and control. |
| Shortener chains | URL Shorteners followed by uncategorized destinations. | Hidden landing pages in phishing. |
| Storage spikes | Large uploads to Cloud Storage / File Hosting outside sanctioned services. | Possible exfiltration. |
| Parked to active | Domains whose category moved from parked to anything new. | Names being prepared for use. |
Shadow IT and AI tool discovery
Security teams increasingly need to know which outside services staff use, not only which ones are malicious. Categories turn a list of domains into a clear picture of services in use.
Group by service type
Count users and traffic per category: cloud storage, file sharing, AI tools, webinars, messaging. The unexpected entries stand out.
Compare with the approved list
Mark sanctioned services, then look at what remains in each category. That is your shadow IT list.
Decide per category
Allow, warn or block by category, with exceptions for approved services. New tools in the category are covered automatically.
Report to leadership
Category level summaries are easy to read for non technical decision makers and privacy teams.
A starter policy by category
| Category | Typical starting action | Common exception |
|---|---|---|
| Malware / Phishing / Suspicious | Block for everyone. | Security team research access. |
| Parked / For-Sale Domains | Block or warn. | Domain management staff. |
| VPN / Proxy / Anonymizers | Block on managed devices. | The corporate VPN service. |
| Remote Access Tools | Block, allow the approved tool only. | IT support staff. |
| AI / LLM Tools | Warn and log. | Approved AI services. |
| File Sharing/P2P | Block. | Approved transfer services. |
| Cloud Storage / File Hosting | Allow sanctioned, warn on others. | Partner shared folders. |
| Newly registered, uncategorized | Warn or isolate for a short period. | Known partner launches. |
Deployment patterns
How the data reaches your tools depends on where decisions happen. Most teams use more than one pattern: a local file for bulk enrichment and hunting, plus exported lists for the resolvers, proxies and firewalls that enforce policy.
Local files
- Downloadable CSV, Parquet or JSON that run inside your own systems.
- Join onto logs in a data lake or log platform.
- Works on premise and in air-gapped networks.
- No lookups leave your network, which keeps browsing data private.
Lookup API and exports
- A lookup API is included with licences for single checks.
- Exports for licensed customers can include hosts files and DNS RPZ.
- Firewall external dynamic lists and PAC files are also possible.
- See download formats for details.
For a deeper comparison, read URL categorization API vs database. For network uses, see DNS filtering security and enterprise network security.
Enrichment fields to add to alerts
When category data is joined to your log platform, these are the fields analysts find most useful on an alert card. Keep the list short so the card stays readable.
| Field | Example value | How analysts use it |
|---|---|---|
| Primary category | Online Banking | First read of what the destination is. |
| Secondary categories | Financial Services | Context for sites that do several things. |
| IAB category | Personal Finance | Finer topic detail for unusual cases. |
| Country | Netherlands | Spot destinations in unexpected markets. |
| Global popularity band | Top 100,000 | Popular sites are rarely the attack domain itself. |
| New domain flag | Registered 3 days ago | Raise priority for fresh names. |
| Uncategorized flag | No category yet | Treat as unknown, not as safe. |
Worked example: a DNS alert at 3 a.m.
An invented case shows how the fields work together. A server in the finance network makes a burst of DNS queries in the middle of the night, when nobody should be using it.
Unusual queries from a finance server
The detection rule fires on volume. Twelve distinct domains appear in the window.
Categories added automatically
Nine are CDN, update and software domains with high popularity. Two are cloud storage. One is uncategorized and registered four days ago.
The analyst skips the noise
Instead of checking twelve names, the analyst looks at the new domain and the two storage services first.
Contain and hunt
The new domain turns out to be a staging point. It is blocked, the server is isolated, and a log search finds one other host that queried it.
Who uses it in a security organization
The same data supports several teams, each with its own questions and its own place in the workflow. Licensing it once for the organization avoids each team building its own partial lists.
SOC analysts
Faster triage on alerts and reported emails, with fewer browser visits to unknown sites.
Incident responders
Quick sorting of every domain touched during an incident into ordinary, suspicious and unknown.
Threat hunters
Category based hunts across months of DNS and proxy logs, without hand built lists.
Governance and risk teams
Reports on which kinds of services staff use, by category, for policy and audit work.
Managed security providers
One data set across many clients, with policies per client built from the same categories.
Security product makers
Category data embedded in DNS filters, gateways and email tools under an OEM licence.
Measuring the effect on the SOC
Before and after numbers make the case for enrichment. Pick a few, measure them for a month before rollout, then track them for a quarter after. Small gains per alert add up quickly across thousands of alerts.
Quick glossary
Terms used throughout this guide, in plain words. They are useful when you explain category based controls to colleagues outside the security team, such as procurement, privacy or leadership.
SOC
Security operations centre, the team that watches alerts and responds to incidents.
Enrichment
Adding context, such as category or country, to raw log entries and alerts.
DNS RPZ
Response policy zone, a standard way to apply block or redirect rules inside a DNS resolver.
Exfiltration
Data leaving the organization without approval, often through storage, file sharing or messaging services.
Command and control
The servers malware contacts for instructions. Often hosted on new, rarely visited domains.
Shadow IT
Software and online services used by staff without approval from IT or security.
Delta file
A daily file listing only domains that are new or changed, so systems stay current without reloading everything.
Newly registered domain
A domain registered recently, often within the last 30 days, with no track record yet.
Limits to keep in mind
Category data is a strong context layer. Used as the only control, it leaves gaps that attackers know well, so plan for them from the start.
Trusted platforms are abused
Lures hosted on cloud storage or form builders inherit a legitimate category. Inspect the full URL and content.
Compromised sites
A real business site can be hacked and serve malware for a short time while keeping its usual category.
Domain level only
Categories describe whole domains. Large sites with user content need page level checks for some decisions.
Fast moving campaigns
Some attack domains live for hours. Pair categories with threat feeds and behaviour based detection.
A layered view: treat categories as the context layer that sits between threat feeds and human analysis. Feeds catch the known bad, behaviour detection catches the unusual, and categories explain everything in between so analysts can spend their time where it counts.
Frequently asked questions
How does domain categorization help a SOC?
It adds a plain label to every domain in an alert, such as Online Banking, Parked / For-Sale Domains or VPN / Proxy / Anonymizers. Analysts see at a glance whether a destination is normal traffic or worth a closer look.
Is a category the same as a threat verdict?
No. Most categories describe what a site is about. Malware / Phishing / Suspicious flags risk directly, and works best alongside threat feeds and sandbox results.
Why are newly registered domains treated as risky?
Many phishing and malware campaigns use fresh names with no history. Legitimate new sites exist too, so many teams watch or restrict new domains for a short period rather than block them forever.
How quickly are new domains categorized?
About 300,000 newly registered domains are categorized every day as daily delta files, then checked again after a week and after a month.
Can category data run in an air-gapped environment?
Yes. The files run inside your own systems, including isolated networks. A lookup API is included with licences where it can be reached.
Which categories matter most for security teams?
Malware, parked, VPN and proxy, remote access, URL shorteners, file sharing, cloud storage and AI tools, alongside business categories for context. More in cybersecurity threat intelligence.
Put a label on every domain in your logs
Over 120 million categorized domains, about 300,000 new domains a day, files that run inside your own network and a lookup API included.