Resources / Blocking
Why we block first
An attack that uses a lookalike address is a race. The message goes out, and the people who are going to be fooled mostly click soon after it arrives. Anything that stops the address working next week has already lost. That is why the first thing we do about a dangerous name is block it, and why blocking is the action at the centre of the service.
Two ways to stop a name
| Removal (takedown) | Blocking | |
|---|---|---|
| What it does | The name stops working for everybody | Mail from the name is refused, and people are warned before a page opens |
| Who has to act | The registrar or the hosting company, if they agree | The blocklist operator, and then every tool that reads the list |
| What it needs | Evidence, a formal complaint, and often a back-and-forth | Clear evidence the name is imitating you |
| How long | Usually days, sometimes weeks, sometimes never | Minutes to hours once it is listed |
| Who is protected | Everybody | Everybody whose mail service, browser or security tool uses the lists |
Removal is the more complete answer, and it is often the slower one by days. It depends on a company that has never heard of you choosing to act. Blocking depends only on the evidence, and it starts protecting people while a removal request would still be waiting for a reply.
How blocklists protect people
Security organisations publish lists of addresses known to be used for phishing, fraud and spam. Mail services check incoming messages against those lists, and browsers, security software and network filters check the addresses people are about to visit. The lists are updated constantly and read constantly, so a name added to one is refused and warned about across all of those tools within a short time, without anybody at the other end having to agree to anything.
What happens when you press Block
1 · You ask
From the name’s page, one click. Blocks protect a domain you have verified by sending us a message from its administrative address. The request uses a block credit and is final.
2 · We check it is not yours
Companies often register their own lookalikes to protect themselves. Our ownership check compares the name with what you own, and a name the check reads as yours is never sent.
3 · A person reviews it
Somebody at Alesian Security reads the evidence before anything leaves, and may decline a request that does not hold up.
4 · We submit it
The name and the evidence go to the organisations that run the blocklists that mail and security tools rely on.
5 · The list acts
The operators make their own decision. Once a name is listed, the tools that read the list start refusing and warning, usually within minutes.
6 · We keep watching
Listings can lapse. We keep checking, and tell you if a name you blocked drops off a list.
What blocking does not do
- It does not delete the name. The address still exists, and somebody whose tools do not use the lists can still reach it.
- It is not our decision alone. Blocklist operators review what they receive and make their own call.
- It is not a tool against competitors or critics. We only send requests against names imitating you to deceive people. See our Acceptable Use Policy.
- It does not rule out removal. When a name needs to disappear for everybody, talk to us. We decide case by case.
Why a block is priced as a decision
What a block credit buys is the work that makes a submission trustworthy: checking the name is not yours, reading the evidence, and standing behind the request. That work is the same whatever the outcome, so a credit is used when we review the request, whether we send it or not and whatever the operators decide. The Terms of Service set this out in full.