not useless, but could be such an easy win. I don’t have a historical need for *-reports-* or reports-*.* or that format with sso, mfa and passkey.
It also depends on your list type!
For Palos:
DNS List: *.domain.test
URL List: domain.test AND *.domain.test
The URL lists on Palos need BOTH entries and this is missed a lot. Seriously. CHECK YOUR EDLs!
URL list formatting on Palos are more capable than DNS: you can block mail.*.* if you’re feeling frisky. But you can’t do mail-* because that would include two tokens in one space, “mail-“ and “*”.
Fortinet is kind of opposite. URL “threat feeds” (EDLs) don’t allow mid string wildcards, only beginning and end, but their domain type does. You can in-fact enter sso-*.* into a Forti.
B'ad Samurai :ifin:
npub1ct…43ll8
2026-10-05 15:54:45 UTC
in reply to nevent1q…867v
Author Public Key
npub1cttkhuyqqd467e9e6j2vkvzl3mp3mh4v8dt3j7au7fy637e70pzq443ll8Seen on
wss://relay.momostr.pinkPublished at
2026-10-05 15:54:45 UTCEvent JSON
{
"id": "508b713d7581919126d8eb7e5acb9be65bf0bd532abb672c477ba8b15b5541a4",
"pubkey": "c2d76bf080036baf64b9d494cb305f8ec31ddeac3b57197bbcf249a8fb3e7844",
"created_at": 1791215685,
"kind": 1,
"tags": [
[
"e",
"7f7c3bb16ec1a023fdec4180560b80a9457e0db79eacf9d9774791dda7421799",
"",
"root",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"e",
"6967a453385a4b0af27c5fdc07c2f30065f7becb57bb3363295521a816ea9456",
"",
"reply",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"proxy",
"https://infosec.exchange/@badsamurai/117389111150945772",
"web"
],
[
"p",
"5941667d19e40b7581976ddf20bfae28022f6837f5467c96f0e377da7ba264a2"
],
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"proxy",
"https://infosec.exchange/users/badsamurai/statuses/117389111150945772",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/badsamurai/statuses/117389111150945772",
"pink.momostr"
],
[
"-"
]
],
"content": "not useless, but could be such an easy win. I don’t have a historical need for *-reports-* or reports-*.* or that format with sso, mfa and passkey.\n\nIt also depends on your list type!\n\nFor Palos: \nDNS List: *.domain.test\nURL List: domain.test AND *.domain.test \n\nThe URL lists on Palos need BOTH entries and this is missed a lot. Seriously. CHECK YOUR EDLs!\n\nURL list formatting on Palos are more capable than DNS: you can block mail.*.* if you’re feeling frisky. But you can’t do mail-* because that would include two tokens in one space, “mail-“ and “*”.\n\nFortinet is kind of opposite. URL “threat feeds” (EDLs) don’t allow mid string wildcards, only beginning and end, but their domain type does. You can in-fact enter sso-*.* into a Forti.",
"sig": "ce3f109291e00ad0717c18e6b3516e66e6dff89ac9c531aa24135e01f2d0507e6589582fbcd5604a7e4f1f82e84c638b31e7201d69f2376efdbe1a336551df86"
}