A Case Study of URL Blocklist Maintenance

The prevalence of malicious websites, such as those involved in online scams or malware distribution, has increased significantly. URL-based blocklists have become widely adopted to mitigate user exposure to these threats. However, the rapid emergence of new malicious websites necessitates continuous updates to these blocklists to remain effective. In this study, we assess the effectiveness of maintaining blocklists by adding new URLs and removing outdated ones. Over a four-month experiment, we analyzed web access logs from 1,663 active users and queried their domains using VirusTotal to obtain related URLs. Investigating the number of security vendor's detection results, we identified 2,050 unique malicious URLs. A daily updated URL blocklist was created and cross-referenced with real user web access logs. Our analysis revealed that 31 users accessed 24 URLs in the blocklist 379 times, demonstrating the practical efficacy of maintaining up-to-date blocklists. Furthermore, we observed instances where users accessed these malicious websites on multiple occasions, underscoring the ongoing relevance of maintaining a current URL-based blocklist to protect users effectively.