# US 8,572,731 B1 · Systems and methods for blocking a domain based on the internet protocol address serving the domain > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,731 B1 - Document ID: US8572731B1 - Status: Granted - Kind: B1 - Application number: 13/298,494 - Filed: 2011-11-17 - Granted: 2013-10-29 - Earliest claimed: 2011-11-17 - Assignees: Symantec Corporation - Applicants: Ian Oliver - Inventors: Ian Oliver - Web page: https://patentgrep.com/patent/US8572731B1 ## CPC - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 63/101: {Access control lists [ACL]} - H04L 63/164: {at the network layer} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method to block a domain based on an Internet Protocol (IP) address serving the domain is described. A trigger event on a first domain is detected. The IP address serving the first domain is identified. The identified IP address is compared with a list of IP addresses. The trigger event is blocked based on a determination that the identified IP address matches at least one IP address on the list. ## Claims ### Claim 1 A computer-implemented method to block a domain based on an Internet Protocol (IP) address serving the domain, comprising: detecting a trigger event on a first domain; identifying at least one additional domain accessed prior to the first domain; identifying the IP address serving the first domain; comparing the identified IP address with a list of IP addresses; and blocking the trigger event based on a determination that the identified IP address matches at least one IP address on the list. ### Claim 2 (depends on 1) The method of claim 1, further comprising analyzing characteristics of the first domain based on the determination that the identified IP address matches at least one IP address on the list. ### Claim 3 (depends on 2) The method of claim 2, further comprising determining whether the first domain is a malicious domain based on the analyzed characteristics. ### Claim 4 (depends on 1) The method of claim 1, further comprising transmitting data relating to the first domain to a back-end server. ### Claim 5 (depends on 4) The method of claim 4, wherein the data indicate whether the first domain is a malicious domain. ### Claim 6 (depends on 1) The method of claim 1, further comprising generating a notification for a user indicating whether the first domain is a malicious domain. ### Claim 7 (depends on 1) The method of claim 1, further comprising identifying an IP address serving the addition domain and determining whether the IP address matches at least one IP address on the list. ### Claim 8 (depends on 7) The method of claim 7, further comprising determining whether the additional domain is a malicious domain based on a determination that the IP address serving the additional domain matches at least one IP address on the list. ### Claim 9 A computing device configured to block a domain based on an Internet Protocol (IP) address serving the domain, comprising: a processor; memory in electronic communication with the processor; instructions stored in the memory, the instructions being executable by the processor to: detect a trigger event on a first domain; identify at least one additional domain accessed prior to the first domain; identify the IP address serving the first domain; compare the identified IP address with a list of IP addresses; and block the trigger event based on a determination that the identified IP address matches at least one IP address on the list. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the instructions are executable by the processor to: analyze characteristics of the first domain based on the determination that the identified IP address matches at least one IP address on the list. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the instructions are executable by the processor to: determine whether the first domain is a malicious domain based on the analyzed characteristics. ### Claim 12 (depends on 9) The computing device of claim 9, wherein the instructions are executable by the processor to: transmit data relating to the first domain to a back-end server. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the data indicate whether the first domain is a malicious domain. ### Claim 14 (depends on 9) The computing device of claim 9, wherein the instructions are executable by the processor to: generate a notification for a user indicating whether the first domain is a malicious domain. ### Claim 15 (depends on 9) The computing device of claim 9, wherein the instructions are executable by the processor to: identify an IP address serving the addition domain and determining whether the IP address matches at least one IP address on the list. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the instructions are executable by the processor to: determine whether the additional domain is a malicious domain based on a determination that the IP address serving the additional domain matches at least one IP address on the list. ### Claim 17 A computer-program product for blocking a domain based on an Internet Protocol (IP) address serving the domain, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions being executable by the processor to: detect a trigger event on a first domain; identify at least one additional domain accessed prior to the first domain; identify the IP address serving the first domain; compare the identified IP address with a list of IP addresses; and block the trigger event based on a determination that the identified IP address matches at least one IP address on the list. ### Claim 18 (depends on 17) The computer-program product of claim 17, wherein the instructions are executable by the processor to: analyze characteristics of the first domain based on the determination that the identified IP address matches at least one IP address on the list, wherein a determination is made as to whether the first domain is malicious based on the analyzed characteristics.