MENU
Why do some domains generate a warning when they are added to the custom blocklist in TAP?
TAP URL Defense custom blocklists can accept domain-based entries, but Proofpoint warns when you attempt to block domains that are widely used by legitimate services (D). Blocking an entire ''popular/prominent'' domain (or a broad wildcard that matches it) can cause major business disruption: break SaaS access, block legitimate customer/vendor communications, and generate a flood of user tickets---ultimately harming containment efforts by forcing emergency rollback. In Proofpoint-focused IR, the safest containment approach is precision: block the specific malicious domain, subdomain, or path pattern when supported, and avoid blanket blocks that collide with common web platforms (cloud storage, URL shorteners, collaboration tools). The warning is a guardrail to prevent overly broad mitigations that create operational outages while providing limited security benefit (attackers can shift infrastructure quickly). When a threat leverages a legitimate platform, IR teams typically prefer tighter controls: block the exact malicious host, apply time-of-click blocking, use isolation/safe browsing controls, and hunt/pull the related emails rather than blocking the entire service domain.