Domain categories

Cloudflare Gateway allows you to block known and potential security risks on the public Internet, as well as specific categories of content. Domains are categorized by Cloudflare Radar.

Cloudflare categorizes domains into content categories and security categories, which cover security risks and security threats:

• Content categories: An upstream vendor supplies content categories for domains. These categories help us organize domains into broad topic areas. However, the specific criteria and methods used by our vendor may not be disclosed.
• Security risks: Cloudflare determines security risks for domains using internal models. These models analyze various factors, including the age of a domain and its reputation. This allows us to identify potentially risky domains.
• Security threats: To identify malicious domains that pose security threats, Cloudflare employs a mix of internal data sources, machine learning models, commercial feeds, and open-source threat intelligence.

You can block security and content categories by creating DNS or HTTP policies. Once you have configured your policies, you will be able to inspect network activity and the associated categories in your Gateway logs.

To request changes to a domain’s categorization, refer to Change categorization. For more information on investigating potentially risky domains, refer to Investigate threats.

​​ Security categories

​​ Content categories

​​ Miscellaneous subcategories

​​ Security risk subcategories

​​ Category and subcategory IDs

​​ Filter by resolved IP category

When creating a DNS block policy for security or content categories, you can optionally enable Filter traffic by resolved IP category in the policy settings. When enabled, Gateway will block queries based on their resolved IP address in addition to the domain name. This setting may increase the number of false positives because domains in the blocked category can share IP addresses with legitimate domains.

​​ Categorization Process

Our domain categorization process consists of a robust data-driven approach that combines Cloudflare’s proprietary data and third-party intelligence (encompassing both open-source and commercial feeds), with machine learning models and insights from our community feedback. This multifaceted strategy ensures the most accurate, timely, and comprehensive domain categorization available.

First, the categorization engine begins with a vast array of data sources. This includes:

1. Cloudflare’s proprietary data leveraging Cloudflare’s extensive network data.

2. Third-party intelligence feeds. We incorporate data from over 30 open-source intelligence feeds and premium commercial feeds, including industry leaders like Avira, Zvelo and others. This aggregation enriches our categorization with diverse insights and global threat intelligence.

Then, the initial categorization is refined and continuously improved through:

3. Machine learning models. Our advanced algorithms, including DGA Domains, DNS tunneling, and phishing detection models analyze patterns and behaviors to detect new and evolving threats.

4. Community feedback. Direct input from our customers plays a critical role in refining and verifying our categorizations. Through a review process, feedback is assessed by both our internal models and threat analysts, ensuring that our categorizations reflect the most current and accurate threat intelligence.

This approach outlines how each component of our process contributes to the creation of a secure and accurately categorized Internet environment. By leveraging both data-driven insights and machine learning, complemented by the critical eye of our community, our categories are not just comprehensive, but also dynamically attuned to the evolving digital landscape.