Threat lists (opt-in)

Off by default. Turn on Use public threat data and FireAI downloads: abuse.ch URLhaus, ThreatFox and Feodo Tracker, Spamhaus DROP, Phishing Army, OpenPhish, the Tor exit list, FireHOL open proxies, CISA KEV, and NIST NVD for your apps’ versions — once a day, with your traffic never sent to any of them.

• Block what a threat list confirms turns matches into an actual block, not just a flag in Threats. It’s off until you turn the first toggle on.
• Update now refreshes the lists on demand; the page also shows when they last updated and roughly how many entries each list holds.
• Google Safe Browsing (optional) adds your own API key so unknown or suspicious names are also checked with Google — only those names are sent, never all of your traffic.

The same on and off switches also appear, in short form, on Protection › Blocklists as “Threat lists” and “Block confirmed threats”. For addresses you add yourself instead, see your own IP blocklist.