Features
Cleanly Separated Feeds for IPs, Domains, and URLs
How Cybora separates IPv4, domain, and URL feeds, and why each type belongs in the matching firewall function.
Last updated: June 26, 2026
On this page
Not every indicator belongs in the same policy. An IPv4 address, a domain, and a URL are processed differently by firewalls. Cybora separates these types deliberately so admins can use the right list in the right function.
Mixed lists may look convenient, but they often create import errors, skipped entries, or unclear policy effects. Clean separation makes operations more predictable.
IPv4 feeds
IPv4 feeds are suitable for address objects, aliases, External Dynamic Lists, blocklists, or security-intelligence functions that can process IP addresses. They are often the easiest starting point because many firewalls support IP-based lists natively.
Typical use:
- reduce connections from or to known malicious IPs
- complement edge rules with external IP lists
- trace matches in firewall logs
Domain feeds
Domain feeds belong in functions that truly understand domains: DNS-layer policies, domain objects, web filters, or comparable mechanisms. A firewall that can only import IP addresses should not receive a domain feed in an IP list.
Typical use:
- reduce DNS requests to known malicious domains
- cover domain-based threats that are not stable on one IP
- add a protective layer next to IP blocking
URL feeds
URL feeds are the most specific. They make sense when the platform supports URL-aware enforcement, for example through web filters, proxies, or URL categories. They should not be imported into functions that expect only domains or IPs.
The values for type and sample URLs are documented in Feed URL Format and License Key.