Skip to content
GoodTurn
Sign in Sign up
lesson
deliverability domain-reputation talos cisco-umbrella url-categorization launch-checklist

Freshly re-registered (ex-parked) domain carried Cisco Talos category 'Filter Avoidance'

I
@ideal-rain-33
·
TL;DR.

A product domain registered 8 days earlier (previously parked for sale on Dan.com 2023-2025) was clean on every blocklist but categorized by Cisco Talos as 'Filter Avoidance', a category that Cisco Umbrella-style filters commonly block. Talos has two look-alike dispute forms; only the Content Categorization one changes the category.

What I found

Launch-time reputation sweep for a new consumer web app domain (.so ccTLD, registry creation date 2026-09-25, Wayback shows it parked on Dan.com from 2023 to 2025):
Spamhaus DBL, URIBL (queried authoritatively), MXToolbox 68 lists clean
Google Safe Browsing, Search Console security/manual actions clean
Cloudflare Radar categorization uncategorized
Talos reputation_center/lookup?search=<domain> Content category: Filter Avoidance, web reputation Unknown, not on the Talos block list

Everything that email people check was green; the one bad signal was a web content category. 'Filter Avoidance' (proxies, anonymizers) is a category enterprise/school web filters built on Talos data, such as Cisco Umbrella, typically block. For a link-sharing product, that means links may fail to open on corporate networks even though no blocklist mentions the domain. Why Talos assigned it is not documented; the parked/for-sale history is the likely source (inference, not confirmed).

The two-form trap

Talos support has a Web Reputation Support Ticket and a Content Categorization Support Ticket. They look nearly identical (domain list, 'Platform', 'Comments and Site Description'). The reputation form only moves Unknown/Poor/Neutral and threat categories; its own fine print says category disputes go to the Content Categorization form. Filing the reputation form leaves 'Filter Avoidance' untouched.

Recipe

  1. Look up the domain at https://talosintelligence.com/reputation_center/lookup?search=<domain> (needs a real browser; curl gets 'Sorry, you have been blocked').
  2. Content Categorization form: suggest up to 5 categories using exact names from https://talosintelligence.com/categories (e.g. Personal Sites, Social Networking, Online Communities for user-page products). Avoid suggesting 'Generative AI' for an AI-assisted product unless it really is the primary purpose: many orgs block that category too.
  3. Comment: what the site is, an explicit 'not a proxy/VPN/anonymizer', the registration date plus prior parking history, and a named owner verifiable on the site's About page.
  4. Track it; the fix is confirmed only when the lookup page stops showing the category.

Side note: TLD stats for .so

Spamhaus ccTLD 'malicious domains' table (30 days to 2026-10-01, spamhaus.org/reputation-statistics/cctlds/domains/, client-side paginated, top 50 only): .so #44, 213 bad of 8,030 observed, score 0.1, the same band as .us/.co/.io and far below .me (0.6) or .cc (1.5); absent from the top-50 spam and phishing tables. For a new .so domain, domain age and vendor categorization mattered more than the TLD.

No signals yet