[Remove] *.rapid7.com

[AL-Cythera]

Domain to remove

insight.rapid7.com

Current blocklist

tracking

Why is this a false positive?

• At least one domain is present in tracking.txt: insight.rapid7.com, possibly more *.rapid7.com domains.
• This is not arbitrary privacy invasion of unsuspecting victims, this is a genuine international cybersecurity provider to detect and respond to vulnerabilities and malicious activity on endpoints
• The only way a device has any reason to interact with this domain or any of its subdomains, is if their security tooling is purposely and specifically chosen to be installed on that device.

Official website or documentation

https://www.rapid7.com/

Impact description

Devices with security tooling being blocked by this tracking list cannot receive updated vulnerability definitions and scan information, and likewise where a vulnerability has been detected, there is no way for the device to make itself known for remediation through the cloud reporting mechanisms.

Cybersecurity vendors, including Rapid7 through their huge contributions to OSS projects like Metasploit, champion privacy controls and freedoms for the organizations they protect AND the broader worldwide population.

Situations like these cast projects like PiHole as an example of how poorly implemented OSS can lead to dramatically worse privacy and security outcomes for its users, and demonstrates how easily gamed by malicious interference they can be.

Urgency

Critical - Security or business impact

Verification

• I have verified this domain is currently being blocked by this project
• I am not affiliated with the domain in a way that creates a conflict of interest
• I understand removal requests are reviewed and may take time

[github-actions]

🔍 Domain Check Result

The domain insight.rapid7.com was found in the following list(s):

• Lists: tracking
• Formats: adguard, dnsmasq, domains, hosts

🔍 Domain Validation

• DNS: ✅ Resolving
• HTTP: ✅ HTTP 200 (https)

---

✅ Domain confirmed in blocklists.

A maintainer will review your removal request. Please provide justification for why this domain should be unblocked.

[AL-Cythera]

Confirmed all Rapid7 agent activities have been blocked since July 4 2026, meaning all Insight agents have not been able to stream security incidents back to cloud OR issue threat containment/quarantine for an entire month.

Pinging Rapid7 about this as it could constitute a notable visibility incident.

chore: update tracking from upstream sources
Added 128817 new domains from upstream sources.

e3a5695

Still unclear which upstream source caused the issue

[ShadowWhisperer]

Whitelisted on my side. Additional domain info

https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/

https://docs.rapid7.com/insightops/api/

[AL-Cythera]

False positives are a fact of life and guaranteed to occur. The primary concern I had in raising this issue was provenance - without knowing precisely when, why, and by whom an indicator was tagged as suspect/malicious, the indicator loses its fidelity.

Without indicator commit history or visibility into upstream feeds in ShadowWhisperer/BlockLists, the downstream consumers such as the blocklistproject ecosystem lack the provenance that provides the fidelity

A significant number of smaller businesses that can't afford premium TI subscriptions do lean on community feeds alongside OTX and Abuse.CH even in their corporate edge appliances. We do not recommend this at all, but for many under-resourced sysadmins they claim it's community feeds or nothing, so we appreciate the rapid turnaround on whitelisting this domain.

[ShadowWhisperer]

Is that what they do? Thanks for enlightening us. My Chevy dealer recommends buying a vehicle over walking, and they conveniently sell them...

Rapid7 is business to business. Not to home users. The types of businesses paying for Rapid7 are not using custom blockers. Your 1st post you say using custom blockers is more harmful than good - Completely blocking Rapid7 would make no difference to them.