BlockMeNot: Automatic Selection of Domain and URL Blocking Granularity to Minimize Collateral Damage and Evasion

Domain and URL blocking is a fundamental mechanism for mitigating malicious, illegal, and inappropriate online content. Yet, selecting the right blocking granularity remains a largely unexplored problem. Overblocking can cause severe collateral damage if the content to be blocked uses the infrastructure of benign services, which may be unintentionally disrupted. Underblocking instead enables trivial evasion. This paper addresses this gap by proposing a novel approach that, given a domain or URL to be blocked, automatically selects the most appropriate blocking granularity (URL, subdomain, or apex) to minimize collateral damage and evasion opportunities. At the core of our approach are two novel machine learning classifiers to identify URL-leasing and subdomain-leasing apexes. The classifiers are trained and evaluated using a manually labeled dataset of 10,843 apexes, achieving F1 scores over 0.9. We implement our approach into BlockMeNot, a tool for identifying potential collateral damage prior to enforcement. We evaluate BlockMeNot on 225,355 entries (i.e., domains and URLs) collected from six blocklists and two threat exchanges. Although only 2.6% of apexes belong to leasers, they host 34.7% of the entries, and up to 71.7% in phishing-focused blocklists, underscoring the importance of fine-grained blocking. BlockMeNot identifies 1,976 leasing apexes, 59.3% of which were not in our ground truth, demonstrating the limitations of static lists and the need for our classifiers. Only 37.2% of blocklist entries are listed at the optimal granularity, 1.3% produce collateral damage, and 61.6% enable easy evasion. Overall, our work provides the first automated solution for domain and URL blocking granularity selection and offers practical guidance for block requesters, executors, and blocklist maintainers.