---
title: "token.safebrowsing.apple: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/token-safebrowsing-apple"
description: "token.safebrowsing.apple is the Apple host for Safari's fraudulent website warnings. What it does, and what breaks if you block it."
---

Security and accounts

# token.safebrowsing.apple

`token.safebrowsing.apple` is the host that Apple lists for “Safari fraudulent website warnings”, on port 443, for iOS, iPadOS, macOS and visionOS.

Run by Apple · Ports: 443 TCP · Checked: 1 November 2026

## Short answer

The Apple host for Safari's fraudulent website warnings.

Don’t block

Don't block it. Safari may stop warning you about fraudulent websites.

Matches

`token.safebrowsing.apple`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `token.safebrowsing.apple` in its Apps and additional content section.

macOS includes a Safe Browsing service, `com.apple.Safari.SafeBrowsing.Service`, in the SafariSafeBrowsing framework. Apple doesn't document it.

`.apple` is a top-level domain, like `.com`. The name is Apple's.

## Processes that use it

- [com.apple.WebKit.Networking](https://kilobat.app/processes/webkit-networking): Part of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it.

## What breaks if you block it

Don’t block

Don't block it. Safari may stop warning you about fraudulent websites.

What breaks if you block it

- Safari's fraudulent website warnings may stop working, so phishing sites aren't flagged.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

To turn the warnings off on purpose, Safari has a setting for it. Blocking the host is a less clear way to do the same.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Support: Avoid fraud by using encrypted websites in Safari on Mac](https://support.apple.com/guide/safari/sfri40697/mac)

Checked on 1 November 2026.

## Related

- [ocsp.apple.com](https://kilobat.app/hosts/ocsp-apple-com): Apple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.