Umbrella offers a feature to proxy requests for URLs, potentially malicious files, and domain names associated with certain uncategorized domains through [Umbrella Intelligent Proxy](https://docs.umbrella.com/deployment-msp/docs/what-is-the-intelligent-proxy).
What are Grey domains?
The intelligent proxy avoids any pre-identified domains which are safe and/or malicious. However, there are certain domains that can be risky in nature. While these domains may not actually be malicious, they can allow the creation and/or hosting of malicious subdomains and content unbeknownst to the domain owners. Hence, these 'grey' domains are flagged as risky domains because they can host both safe and malicious subdomains/content. These uncategorized sites can include popular sites, such as file-sharing services.
What is a Greylist?
The greylist is a list of risky Grey domains the Intelligent Proxy intercepts and proxies to confirm if it indeed is malicious or not. It is a dynamic list of grey domains our security research team keeps track of.
For example: Let's say ```examplegrey.com``` is a domain which allows users to host their own content. While the domain itself could be safe, a malicious actor could host malicious content/subdomain such as ```examplegrey.com/malicious```. At the same time it could also have other non-malicious content hosted as ```examplegrey.com/safe```. Hence, keeping examplegrey.com in the 'greylist' helps block the malicious content(```examplegrey.com/malicious```) while allowing the safe one(```examplegrey.com/safe```).