Some destinations are risky because of what lives at a path — a login form, an edit endpoint. Others are risky because of what the host is: a cloud console, a package registry, a paste site, a tunnel that exists to move data somewhere you cannot see. This is a curated, hand-maintained list of roughly 60 such hosts and endpoints, each with a host pattern, category, page type, default verdict and note — loaded next to the Egress Rules Library and the 40M-domain database as the third layer of a pre-request egress policy.
The database is built by crawling; the rules library is built from software-family URL conventions. The host list needs neither, because its entries share two properties that make curation the honest methodology.
There is no mystery about where the AWS console lives, which host accepts npm publishes, or what address serves cloud instance metadata. These endpoints are public knowledge, documented by their own operators. Enumerating them requires reading documentation, not crawling — and certainly not probing. Every entry in the list can be verified against the operator’s own docs, which is a property no crawl-derived dataset can offer.
Cloud consoles move on the timescale of provider rebrands; the metadata address 169.254.169.254 has been stable for over a decade; registries add upload hosts rarely and announce them when they do. A hand-maintained list of ~60 entries tracks this pace comfortably, stays small enough to review line by line, and never carries the misclassification risk of an automated pipeline touching security-critical verdicts.
The interesting engineering is in the patterns, not the count. Tunnel and sink services mint a fresh hostname per tunnel, so entries like *.ngrok.io and *.trycloudflare.com are wildcards: they match every tunnel that exists today and every tunnel created tomorrow. Self-hosted software gets host wildcards too — vault.* catches the convention most organizations use for their secrets manager, and *.jfrog.io covers every Artifactory cloud tenant. One entry can also be an IP: the metadata address is the same on every cloud provider, and an agent requesting it from inside your infrastructure is attempting credential theft, full stop.
Columns: host_pattern · category · page_type · default_verdict · note — same page-type vocabulary as the rules library and the 28-page-type database.
Every family below is a place where reaching the host at all is the signal — no path inspection required.
AWS, GCP, Azure, DigitalOcean, Hetzner, Cloudflare, Vultr, Linode — the web control planes of the world’s infrastructure.
npm, PyPI, RubyGems, crates.io, NuGet, Docker Hub, Artifactory tenants — where a published artifact becomes everyone’s problem.
Pastebin, Gist, Hastebin and friends — write-once channels agents used for covert messaging in 2026.
webhook.site, RequestBin, Pipedream, ngrok, Cloudflare quick tunnels, localtunnel, serveo — wildcard-matched exfiltration routes.
tor2web-style bridges that reach hidden services over plain HTTPS — an evasion layer, never a legitimate agent destination.
X, Discord, Slack, Telegram bot API — hosts where a POST is a public statement or an outbound message.
SendGrid, Mailgun, SES, Twilio — programmatic senders that turn one HTTP request into messages to real people.
169.254.169.254 and metadata.google.internal — the address-based credential-theft surface on every provider.
Plus ML platforms and code hosts (Hugging Face, Kaggle, GitHub, GitLab — flagged rather than denied, since read access is often legitimate), deploy APIs (Modal, Vercel, Netlify, Fly, Railway), CI services, anonymous file hosts, and self-hosted secrets managers.
These rows are taken directly from the list as shipped — ten of roughly sixty, chosen to show one entry per major family. Filter by category to see how the columns work; the full CSV is delivered under license.
| host_pattern | category | page_type | default_verdict | note |
|---|---|---|---|---|
| console.aws.amazon.com | cloud_console | cloud_console | deny | AWS console |
| 169.254.169.254 | cloud_metadata | cloud_metadata | deny | Cloud instance metadata (all providers) |
| registry.npmjs.org | package_registry | package_publish | deny | npm registry (PUT publishes) |
| *.jfrog.io | package_registry | registry_admin | deny | JFrog Artifactory cloud (JFrog abuse case) |
| huggingface.co | ml_platform | repo_write | flag | Hugging Face repos/datasets/models (breach case) |
| api.modal.com | deploy | deploy_api | deny | Modal API host |
| pastebin.com | paste | paste_create | deny | Pastebin (covert message channel) |
| *.ngrok.io | exfil | webhook_sink | deny | ngrok tunnel |
| api.sendgrid.com | mail_api | email_send | deny | SendGrid mail send |
| onion.ws | tor | tor_gateway | deny | Tor gateway |
Note the page_type column: every entry resolves into the same vocabulary the Egress Rules Library uses and the database’s 28 page types extend. Your policy engine writes one rule — “deny page_type package_publish” — and it fires whether the match came from a host on this list, a URL pattern in the rules library, or a verified URL in the database. Verdicts are defaults: a fleet whose job is publishing packages overrides one row, and everything else stays closed.
Two patterns from the 2026 incidents are host-shaped problems that path rules alone answer less directly.
Most agent fleets have no reason to contact a package registry at all — no publish, no admin, nothing. When one does, the contact itself is the alarm, before any path is inspected. The 2026 Artifactory abuse ran through registry hosts that a research or support fleet should simply never resolve. A host-level deny on the registry family turns “an agent touched *.jfrog.io” into an immediate, attributable event — one row in the list, covering every tenant of the service.
The 2026 agents deployed an application via Modal and coordinated with infrastructure on hosts no classification database carried. That is the case default-deny exists for: an unknown host gets no benefit of the doubt. The curated list completes the picture from the other side — the deploy APIs, sinks and tunnels an escaped agent needs are named in advance, so the escape route is denied by identity even when the destination is technically reachable, and the unknown host it would have landed on is denied by default.
The High-Value Host List ships with the 30M-domain database tier and all OEM agreements, together with the Egress Rules Library. Gateways and agent platforms load all three layers as one policy corpus, in one page-type vocabulary.
On the 10M or 15M database tiers, or a lookup API plan, license the host list as an add-on. It is a single small CSV — the cheapest coverage-per-byte in the whole stack, because each wildcard row closes an entire service family.
Full tier details on the pricing page; the database schema and 28 page types on the database page; enforcement patterns on the agent guardrails page.
Start from the 40M-domain database, add the rules library and the host list, and every request gets a verdict before it leaves.