Does connecting a control block anything?

No. A control blocks only the domains your rules flag or your team sends by hand.

Could our own domains end up blocked?

No. Your monitored domains and their subdomains never go into a block list.

Gateway and endpoint blocks never expire, so a domain can't slip back in just before attackers reuse it. Microsoft 365 Quarantine blocks last 30 days and renew when a rule cites the domain again.

What if our firewall isn't listed?

Firewalls that fetch a list over HTTPS, such as Palo Alto, Fortinet, Check Point, Sophos and pfBlockerNG, can read the domain feed.

Which plans include Network Enforcement?

Network Enforcement is an Enterprise add-on.

Network Enforcement

Block malicious domains
across every control you run

Phishing links reach inboxes faster than anyone can update a block list. When a rule flags a domain, every control you run blocks it automatically.

Book a demo

How it works

Flag a domain once,
block it everywhere

Your rules push each flagged domain to every connected control, without anyone opening a console.

Decide once

A rule decides what gets blocked, so your team never maintains a block list by hand.

Every control in sync

Gateways, endpoints, mail filters and firewall feeds receive the domain from the same rule, and every delivery is recorded for audit.

Blocked on the next click

The next person to click the link sees a block page instead of the attacker's sign-in form.

Alertsacme-billing.comHigh

Credential phishing page detected

Verdict: Phishing95%
Registered: 3 days ago
Page: Sign in to Acme

Responses

Cloudflare Zero TrustGateway listListed
Zscaler Internet AccessURL categoryListed
Defender for EndpointBlock indicatorCreated
Domain feedFor your firewallsPublished

Zero Trust/AcmeSupportAccount

Overview
Analytics
Gateway
Access
Networks
My Team
Users
Devices
Lists
Logs
Settings

My TeamLists

haveibeensquatted-a1b2c3d4-noedit

Domains4 entriesUsed in 1 policy: Block lookalike domains

ValueDescription

acme-billing.comhibs:1;rule=8c1f2e7a…;seen=… | IOC blocked by a Have I Been Squatted rule

acme-sso.nethibs:1;rule=8c1f2e7a…;seen=… | IOC blocked by a Have I Been Squatted rule

acmehelp.comhibs:1;rule=8c1f2e7a…;seen=… | IOC blocked by a Have I Been Squatted rule

acrne-login.comhibs:1;rule=8c1f2e7a…;seen=… | IOC blocked by a Have I Been Squatted rule

This website is blocked

Your organization's security policy blocks acme-billing.com.

Cloudflare Gateway

Controls

Block in the tools
you already use

Rules tell your gateways, endpoints and mail filters which domains to block. A domain feed covers any firewall or DNS resolver that reads a list.

Web gateways

Endpoints

Mail

Firewalls and DNS

Domain feed

Such as Palo Alto, Fortinet, Check Point and pfBlockerNG, or any firewall that reads a list

FAQ

Frequently asked questions

Abusive infrastructure,
disrupted

Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.

Book a demo

Flag a domain once,block it everywhere

Block in the toolsyou already use