Skip to content
Articles
Phishing

Block tunnels and dynamic DNS: throwaway addresses your business doesn't need

Attackers host malware and phishing on free tunnels and dynamic DNS names, then move on before block lists catch up. Why ordinary businesses can block them outright, the free way to do it in Chrome and Edge, and how Browser Rules does it with a maintained list.

20 October 2026 · Browser Rules · 4 min read

Most of the websites attackers use don’t last long. They set up an address, use it in a campaign for a few hours or days, and move on before anything blocks it. Two kinds of free service make that especially easy: tunnels and dynamic DNS.

Both have genuine uses, mostly for developers and home users. An ordinary business rarely needs to visit either. That makes them low-hanging fruit: you can block them outright, and stop a whole class of throwaway addresses before anyone clicks one.

What they are

  • Tunnels put a computer on the internet for a while, at a public address, with no server and no domain to buy. Examples are Cloudflare Quick Tunnels (trycloudflare.com), ngrok, localtunnel and Microsoft Dev Tunnels. Developers use them to show work in progress.
  • Dynamic DNS gives a free name that points at a home or rented computer, and follows it when its internet address changes. Examples are DuckDNS, No-IP’s free names (such as ddns.net and hopto.org), Dynu and FreeDNS. People use them to reach a home camera or a small server.

Why attackers use them

  • They’re free and need little or no sign-up. Cloudflare’s quick tunnels need no account at all (Proofpoint).
  • A new address takes seconds. A dynamic DNS name like secure-login.duckdns.org can be made in seconds, used in a phishing campaign, then abandoned once it’s flagged (Allure Security).
  • Block lists can’t keep up. Lists of known bad addresses lag behind attackers who burn through new names faster than the lists update.
  • The address looks harmless. It sits under a well-known service, so a user, or a filter that trusts the parent domain, may let it through.

This isn’t theoretical. From February 2024, attackers used Cloudflare’s free tunnels to deliver remote access malware such as Xworm, AsyncRAT and Remcos, in campaigns of up to tens of thousands of emails, reaching thousands of organisations (Proofpoint).

Before you block: who uses them?

Blocking is safe for most staff, but check two groups first:

  • Developers and IT staff may use ngrok or Dev Tunnels for real work.
  • Remote access to the office. Some small businesses reach a camera, a NAS or a VPN through a dynamic DNS name. NAS makers’ own names, such as synology.me and myqnapcloud.com, are a different case and usually fine to keep.

Allow what you need for the people who need it, and block the rest.

The free way: Chrome and Edge policy

Chrome and Edge can block websites by policy, with no extra software. The URLBlocklist policy takes a list of domains, and each one blocks the domain and every name under it, so duckdns.org covers anything.duckdns.org (Chromium). Set it with Group Policy, Intune or Google Admin, once for each browser.

It works, but you keep the list yourself, and new services appear. The user sees the browser’s own “blocked” page, which doesn’t say why. IT doesn’t see who tried to visit, and making an exception for one group means a second policy for that group.

If you already use DNS filtering, check whether it has a dynamic DNS category. Many do, and it covers every app on the computer, not only the browser.

How Browser Rules does it

Browser Rules has two built-in lists, Tunnels and Dynamic DNS, that we keep up to date, and a rule for each in its Rule Library:

  1. In the admin console, open Protection, Websites, and choose Add policy.
  2. Choose Block tunnel addresses, and add it. Do the same with Block dynamic DNS addresses.
  3. If someone needs one, add an Allow policy above it, for their group and the address they use.
  4. Publish the changes. Browsers pick them up within a few minutes.

Then:

  • Every name under each service is covered, and new services join the lists as we find them, with nothing for you to change.
  • Users see why. “Addresses like this are often used to host malware for a short time. If you need it for work, ask IT.” Or your own message, with your contact details.
  • IT sees who tried. Each block is recorded in the audit log, with the website and the policy.
  • Chrome and Edge work the same, from one place.

Not sure who uses them yet? Add the rules with the action set to Audit at first. The audit log then shows every visit, without blocking anything, and you can switch them to Block a week later.

What it doesn’t cover

  • Other apps. A browser rule protects the browser. A command run outside it, such as a ClickFix command that downloads from a tunnel, isn’t covered here. Browser Rules stops the ClickFix step itself, and DNS filtering or endpoint protection covers the rest of the computer.
  • Other free hosting. Attackers also use free web hosting, file sharing and form builders that businesses do need. Those call for warnings or narrower rules, not a blanket block.

Tunnels and dynamic DNS are among the easiest wins in browser security: rarely needed at work, and widely used by attackers. Block them, allow the few exceptions, and attackers have one less place to hide. Browser Rules is free for up to 50 users.