Resources / Blocking
Why we block first
An attack that uses a lookalike address is a race. The attacker sends the message, and most of the people who fall for it click soon after it arrives. An action that stops the address next week is too late. So the first thing we do about a dangerous name is block it. Blocking is the action at the center of the service.
Two ways to stop a name
| Removal (takedown) | Blocking | |
|---|---|---|
| What it does | The name stops working for everybody | Mail filters refuse mail from the name, and browsers warn people before a page opens |
| Who has to act | The registrar or the hosting company, if they agree | The blocklist operator, and then every tool that reads the list |
| What it needs | Evidence, a formal complaint, and often a back-and-forth | Clear evidence the name is imitating you |
| How long | Usually days, sometimes weeks, sometimes never | Minutes to hours once it is listed |
| Who is protected | Everybody | Everybody whose mail service, browser or security tool uses the lists |
Removal is the more complete answer, and it is often the slower one by days. It depends on a company that has never heard of you choosing to act. Blocking depends only on the evidence, and it starts protecting people while a removal request would still be waiting for a reply.
How blocklists protect people
Security organizations publish lists of the addresses that attackers use for phishing, fraud and spam. Mail services check incoming messages against those lists. Browsers, security software and network filters check the addresses that people are about to open. The organizations change the lists all the time, and the tools read them all the time. When a name goes on a list, all of those tools refuse it or show a warning in a short time. Nobody at the other end has to agree.
What happens when you press Block
1 · You ask
From the name’s page, one click. Blocks protect a domain you have verified by sending us a message from its administrative address. The request uses a block credit and is final.
2 · We check it is not yours
Companies often register their own lookalikes to protect themselves. Our ownership check compares the name with what you own, and a name the check reads as yours is never sent.
3 · A person reviews it
Somebody at Alesian Security reads the evidence before anything leaves, and may decline a request that does not hold up.
4 · We submit it
The name and the evidence go to the organizations that run the blocklists that mail and security tools rely on.
5 · The list acts
The operators make their own decision. When a name goes on the list, the tools that read the list start to refuse it and to warn people, usually within minutes.
6 · We keep watching
Listings can lapse. We keep checking, and tell you if a name you blocked drops off a list.
What blocking does not do
- It does not delete the name. The address still exists, and somebody whose tools do not use the lists can still reach it.
- It is not our decision alone. Blocklist operators review what they receive and make their own call.
- It is not a tool against competitors or critics. We only send requests against names imitating you to deceive people. See our Acceptable Use Policy.
- It does not rule out removal. When a name needs to disappear for everybody, talk to us. We decide case by case.
Why a block is priced as a decision
A block credit pays for the work that makes a request trustworthy. We make sure that the name is not yours, we read the evidence, and we put our name on the request. That work is the same for every result. So we use a credit when we review the request. It does not matter if we send it or not, or what the list operators decide. The Terms of Service set this out in full.
Open a free account and watch your domain. Block a dangerous name when one appears.