Malware and phishing blocklists
TL;DR
Public blocklists name domains that host phishing pages or malware. A site on one is blocked by filtering DNS, ad blockers and security software — often because it was hacked, not because its owner did anything.
Explain Simply
A blocklist is a list of shops the neighbourhood was warned about. If your shop is on it by mistake, or because a thief used your back room, customers are turned away at the door until you clean up and ask to be taken off.
Security groups publish lists of domains seen hosting phishing pages (fake bank or e-mail logins) or malware. Filtering DNS resolvers, ad blockers, firewalls and security software download these lists and block visits to every name on them.
Most listed small-business sites were compromised: an outdated plugin or a stolen password let someone upload a fake login page or a redirect. The owner often learns about it only when visitors say the site is blocked.
A list can also name a parent domain. On a shared host (one domain, many tenants, such as a site builder) one bad tenant can get the shared name listed.
Google keeps its own list (Safe Browsing). Its verdict on your site is in Search Console under Security Issues and in the Google Transparency Report.
⚡Why It Matters
A blocked site loses visitors it never sees, and a phishing page on your domain harms the people who trust your brand. Finding a listing early is how you find a compromise early.
🔍How CiteStat Checks
CiteStat looks the scanned host and its parent domains up on two public lists with licences that allow commercial use: UT1 phishing (Université Toulouse Capitole, CC BY-SA 4.0) and Phishing.Database ACTIVE domains (MIT). The match is exact on the name, never on part of it. These are not Google's lists.
CiteStat Score Impact
Shown in the Technical card. A listing is a high-severity finding with a fix; no points are deducted.
Fix Difficulty
Editor: N/A | Developer: Medium | AI Agent: Medium