List URL syntax and matching criteria for URL lists and feeds

Security Intelligence URL lists and feeds, including custom lists and feeds and entries in the global Block list and Do Not Block list, can include hostnames, URLs, slashes for exact matches, wildcards, and IP addresses, each with specific matching behavior.

Hostnames

For example, www.example.com.
URLs
- example.com matches example.com and all subdomains, including:
  - www.example.com
  - eu.example.com
  - example.com/abc
  - www.example.com/def
- Does NOT match:
  - example.co.uk
  - examplexyz.com
  - example.com.malicious-site.com
- When a feed or list includes a single entry, every URL that ends with those domains is identified and blocked
- Example feed:
  
  If you add www.netflix.com, www.amazon.*, org, edu, www.hulu.* to the feed, these are blocked:
  - http://www.amazon.in
  - http://www.rajiv.org/
  - http://www.edu.edu/
  - http://www.edu.org/
  - http://org.org/
  - http://edu.edu
- You can also include an entire URL path, such as https://www.cisco.com/c/en/us/products/security/firewalls/index.html

Custom feeds with embedded credentials:

You can create a custom URL, Network, and DNS feeds, including the username and password inside the URL (for example: https://admin:password@server.domain.com/list.txt).

Note	If your password contains special characters (such as a colon (:) or an at sign (@)), transmission would fail. Ensure that your passwords do not contain these special characters, or use encoded passwords.

A slash at the end of a URL to specify an exact match

example.com/ matches only example.com; it does NOT match www.example.com or any other URL.
A wildcard (*) to represent any domain in a URL
- An asterisk can represent a complete domain string separated by dots, but not a partial domain string, and not any part of the URL following the first slash.
  
  Valid examples:
  - *.example.com
  - www.*.com
  - example.*
    
    (This will match example.com and example.org and example.de, for example, but not example.co.uk)
  - *.example.*
  - example.*/
  Invalid examples:
  - example*.com
  - example.com/*
IP addresses (IPv4)
- For IPv6 addresses, or to use ranges or CIDR notation, use the Security Intelligence Network object.
- You can include one or more wildcards representing an octet, for example 10.10.10.* or 10.10.*.*.