Malware & C2
Threat intel feeds block known-bad infrastructure — malware delivery, botnet control, cryptominers, info-stealers.
SERVICE · DNS
Block the
Block the
lookup.
Skip the breach.
Protective DNS / DNS-layer filtering for UK SMBs
Protective DNS on every device, everywhere they go. Malware can't call home if it can't resolve the hostname. Phishing can't harvest credentials from a page that never loads.
Cloudflare Gateway
DNSFilter
Roaming agent
Anywhere, any network
01 / WHAT'S INCLUDED
Six categories
Six categories
of lookup
we handle.
Phishing & newly-registered
Known phish domains blocked. Newly-registered and newly-observed domains quarantined by default — the first 24h is when phish runs hot.
Content categories
Adult, gambling, weapons, P2P, proxies, anonymisers. Set your policy, we enforce it with audit trail.
Cloud/shadow IT control
Block or allow specific SaaS apps (uncontrolled Dropbox, personal Gmail, AI tools). Data-exfil mitigation, visibility included.
Roaming enforcement
Agent on Windows and macOS. Protected at home, on hotspot, at the coffee shop — same policy as the office.
Log, hunt, report
Full DNS query log piped to the SOC. Used for threat hunting, compliance and post-incident investigation.
02 / HOW WE RUN IT
Scope. Deploy.
Scope. Deploy.
Tune. Watch.
- STEP 01
Scope
Short workshop: what categories to block, which SaaS to gate, who the exceptions are (execs, marketing). Policy documented.
- Policy pack
- Exception register
- Roll-out plan
- STEP 02
Deploy
Agent pushed via MDM. Office DNS pointed at the filter. Roaming clients register automatically. Typical full deploy: one business day.
- Intune / Addigy push
- Office DNS
- Roaming live
- STEP 03
Tune
First 2 weeks: unblock workflow triaged daily. By week 3, noise is ~zero. Self-service unblock portal live for users.
- Self-service unblock
- False-positive review
- Category refinement
- STEP 04
Watch
Query logs feed the SOC. Suspicious patterns (DGA-like, C2 beacons, data-exfil) trigger investigation — not just blocked, investigated.
- SOC feed
- Monthly report
- Threat hunts
03 / WHY IT MATTERS
The cheapest
The cheapest
control with
the biggest bite.
Every malware and phishing operation starts with a DNS lookup. Block the lookup and almost everything else gets easier: fewer EDR alerts, fewer user clicks to triage, fewer ransomware near-misses. For a few pounds per user per month, it's the single best-value security control we deploy.
- ✓Commodity threats stopped at the queryMost malware never makes it past the first DNS call.
- ✓Everywhere protectionHome, hotel, tethered. Doesn't matter — policy follows the device.
- ✓Shadow IT visibilityWhich SaaS apps are people actually using? Now you know.
- ✓Evidential logsEvery query archived. Priceless for incident response and audits.
04 / FAQ
Questions
Questions
we hear a lot.
Isn't DNS filtering just an ad blocker?
No. Ad blockers run per-browser. Protective DNS runs at the network layer for every app, every connection. It blocks malware C2, phishing, and known-bad infrastructure before anything connects.
Does it work off-network?
Yes. Roaming agents on Windows and macOS route DNS to the filter anywhere — home, hotel, coffee shop, tethered. Same policy everywhere.
Will it block legitimate sites?
Occasionally, at first. We tune categories to your industry during onboarding, and users can request unblocks via a self-service page — approved/denied by your admins, not us.
What does it cost relative to the value?
DNS filtering is the highest-ROI security control we sell. A few pounds per user per month, blocks the overwhelming majority of commodity phishing and malware before it can do harm.
Which vendor do you use?
Cloudflare Gateway for most — great performance, excellent integrations. DNSFilter for clients needing deeper category control. We pick per fit.
Does it conflict with VPNs?
No, when configured correctly. We handle the co-existence with your VPN/SSE stack during deployment.
RELATED SERVICES
Often runs with.
01
Managed EDR
DNS catches the lookup; EDR catches anything that bypasses it. Defence in depth.
Read more 02Email security
Email security rewrites the URL, DNS filtering blocks the query if it ever resolves.
Read more 03Patch management
Close the known holes attackers exploit. Pairs with DNS for a clean preventive posture.
Read more
NEXT STEP
48-hour
48-hour
passive audit.
Point your DNS at our collector for 48 hours. We'll show you every risky query, every shadow-IT app, every potential C2 your stack missed.