Malware
Blocklist
Also called blacklist.
Blocklist is a list of hosts, URLs, or file hashes you refuse to load or visit. It catches what someone has already reported, which is both its value and its limit.
How it is measured
A blocklist is a lookup. For each outbound host or script URL, you check whether it appears in the list and return allow or deny. Size, update frequency, and source decide how useful it is: a feed refreshed daily beats a static file from 2021.
Measure it by hit rate and age. How many requests did it block this week, and how old is the newest entry? A list that never matches anything is either clean traffic or a dead feed.
Worked example
A DNS filter on an office network pulls a malware domain feed every four hours. Tuesday morning a laptop tries to resolve `secure-login-paypa1.com`. The domain was added to the feed at 06:10. The lookup is refused and the filter logs one block.
The same laptop is then pointed at a fresh domain registered an hour ago, `docs-viewer-share.xyz`. It is not on any list yet, so it resolves. The blocklist did exactly what it promises: nothing before someone reported it.
How it differs
A blocklist denies the known bad and permits the rest. An allowlist permits only the known good and denies the rest. Blocklists rarely break legitimate pages, but they trail attackers. Allowlists lead attackers but need maintenance every time a vendor changes hosts. Hack Check uses the Tarsier Threat Index, Tarsier's own hostile-host list, as its blocklist.
Common errors
Treating a clean result as proof of safety. Using a feed with no update date. Blocking a whole shared host like a CDN domain and breaking half the web. Forgetting to remove entries after a domain is cleaned up. Copying an old list between servers and never refreshing it.
In practice
Check how old your list's newest entry is. If it is more than a few days, find a fresher source or schedule the refresh. Keep a small local override file for hosts you have personally confirmed as hostile, and log every block so you can spot a legitimate service you are hurting.